Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 7d41f54ddb03ead4…

MALICIOUS

Office (OOXML) / .XLSX

126.6 KB Created: 2021-10-27 10:31:49 UTC Authoring application: Microsoft Excel 12.0000
MD5: 7d0b560c7ee2f0ee08b8cc237a7f7708 SHA-1: 50df140f3628b24c22245e9ff5c12cb168d8d2dc SHA-256: 7d41f54ddb03ead475ba45aa521397f989ee75f625a15cc7aee755d4bf7875f0
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell

The critical heuristic firing indicates the presence of an Excel 4.0 macro sheet. Analysis of the macro sheet reveals it constructs and executes a command to run a VBScript located at the UNC path '\\server\share\file.vbs'. This script is likely designed to download and execute a second-stage payload, contributing to the overall malicious intent of the document.

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
b0398a5f1dff9639ba2c28d7bd14ef6de0c183bea8ccace998b3dfa80c37b20a		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 1724 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.