Office (OOXML) / .XLSX malware analysis — malicious · 72537fa5acb06c4e

MALICIOUS

Office (OOXML) / .XLSX

1.16 MB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-03-30

MD5: 30b24ae7d51f44b876901a95f1e25e5a SHA-1: c8d4ae61fc6df5655f4071158926a9c7deb759b5 SHA-256: 72537fa5acb06c4e9fb5f3137a45f21e5e93de8a4fcd6214b32a952a8f930b79

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical heuristic firing indicates the presence of Excel 4.0 macros within the XLSX file. These macros are often used to download and execute additional malicious content. While the specific commands within the macros are obfuscated, their presence strongly suggests an intent to compromise the user's system. The file's nature as an XLSX document also points to it being delivered as a spearphishing attachment.

Heuristics 1

Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`emf_00.emf` `a12daa770fc1848e39c880d90376e8e5b6814576e9bdbfaa076685fd9b9b2ba3`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	6145428 bytes
`xlm_sheet_00.bin` `94dcae400bad291e7734b3303be72f72bc74b4ef3f7737fe960644bb383a7a69`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	484 bytes
`xlm_sheet_01.bin` `6b69a539d2d44586cd29d86a91c29f1e2ba8aa4a323b5a4a9f7f0d23cd002d42`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.bin	484 bytes
`xlm_sheet_02.bin` `46ff111a4683eea3ae97021320d38aa4eb315350d26452c986cde8fd19a80a92`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin	2165 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.