Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 7de8eeefa0745c53…

MALICIOUS

Office (OOXML) / .XLSX

119.9 KB Created: 2021-10-27 10:31:49 UTC Authoring application: Microsoft Excel 12.0000
MD5: 8ffed0b0582649f47db5b2707de85714 SHA-1: a77a62cb1254a5456446df615fc854cde0fe2129 SHA-256: 7de8eeefa0745c539e51cb8b15afb5d3521263f59b3df22c5e395ceed07ec80e
60 Risk Score

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
9d6fd52bee1a4257e7f6a19ed51feb4599bc2bfddce54d61f565e68ec3bc2d46		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 4502 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.