Office (OOXML) / .XLSM malware analysis — malicious · 85d4e3e3b7b8a330

MALICIOUS

Office (OOXML) / .XLSM

478.1 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2026-05-19

MD5: 3b814512f5c7b9618f9f6b9016f6b47e SHA-1: 5fcf7c5bedb99fcc7edd7625c4b53eb1aa3c0267 SHA-256: 85d4e3e3b7b8a330e04fe4a3a568f909b795e1c10fa824c49178462bead48d17

182 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel 4.0 macro sheet that contains WinAPI and download strings. The document body explicitly mentions downloading a file from http://149.3.170.235/qw-fad/host.exe using functions like DownloadToFileA and CreateDirectoryA, indicating it's a downloader. The Auto_Open defined name suggests automatic execution upon opening.

Heuristics 4

Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS

Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://149.3.170.235/qw-fad/host.exe In document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.