Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8f4be2b347d78945…

MALICIOUS

Office (OOXML)

83.9 KB Created: 2021-01-31 17:47:11 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-02-20
MD5: 64e2bd9a5f8dfbe7756b77df4029f31c SHA-1: e109d4d64015dc9a1410b0c09b18107f0ac50f60 SHA-256: 8f4be2b347d78945f1c87eed3b5990ab1d741d5c2cca6fc50d8822228528b342
60 Risk Score

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 2633 bytes
SHA-256: 0877fa54025c919d0059c8b97cbe617ed1aca01a29058de9a1f8311cc6317f1e
Preview script
First 1,000 lines of the extracted script
�  �  �   @      ��������    �                  �  %      ��                  & �  �             @   d           � $                                    �  �  %      ��    & �  ����  ,     �  <         �%        <     �?  $	        �  �  %      ��    &           ,                	,              Y@       d      d     B       %      ��    &           ,                
                $     �B  �    %      ��    &           ,                	'             Ђ@  
       �  � B       %      ��    &           ,                	,              i@       �      �     B       %      ��    &           ,                          ?   %      ��    &           ,                	E              �?  +   Z       �:       �:      
�:       �   B �     %      ��    &           ,                          @   %      ��    &           ,                	,              y@       �      �     B       %      ��    &           ,                
:           '       AJ  @     0 0 : 0 0 : 0 3  @   B ��    %      ��    &   	       ,                          A   %      ��    &   
       ,                	T           �����  :   Z       �:       �:      
�   :       �:      	�      B �     %      ��    &           ,                          B   %      ��    &           ,                	,             Ȅ@       �      �     B       %      ��    &   
       ,                
                $     �B  �    %      ��    &           ,                	'             _�@  
    �  �  G B       %      ��    &           ,                
:           '       AJ  @     0 0 : 0 0 : 0 5  @   B ��    %      ��    &           ,                	0             8�@       �      �         B       %      ��    &           ,                
                $     �B  �    %      ��    &           ,                	-             ��@          b  �  �    B       %      ��    &           ,                          C   %      ��    &           ,                	0             �x@       �      �         B       %      ��    &           ,                	a              E@  G   Z       �:       �:       �   :  
    �:       � @  :       �      B	�     %      ��    &           ,                          D   %      ��    &           ,                          E   %      ��    &           ,                
                B 6     �  � � ��                                                                  @   �K�XR��o;D���g�	� ! ��VG# �H6�x� T�4-f�
1  �Bĸ�F[ c ���|e Xjo�    .��R �49�)k˛�>�    S H A - 5 1 2 � B                                                                  �  � � 0ffffff�?ffffff�?      �?      �?333333�?333333�?%      ��                  & �

Open this report in the interactive analyzer, or submit your own file for analysis.