Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 90b50a8626dbe5e1…

MALICIOUS

Office (OOXML) / .XLSM

27.4 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300
MD5: b21da197e9de2761c7e351e0a457f808 SHA-1: b9fb35d90f6d91559e4a65fe0fc8032d46f26f11 SHA-256: 90b50a8626dbe5e11199559bb736d6f7d10a698d6f4bf58255eff3c3eceab71f
108 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Service Execution: Service Execution T1204.002 Malicious File: Malicious File

The file is an XLSM document containing Excel 4.0 macros, which is a known technique for malware delivery. The heuristics indicate the use of dangerous XLM functions like REGISTER, which can be used to call arbitrary Win32 APIs. This suggests the macro is designed to download and execute a second-stage payload. No specific family could be identified, and no IOCs were directly extracted from the document body or scripts.

Heuristics 4

  • Dangerous XLM formula APIs: REGISTER, HALT, RETURN critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Excel 4.0 macro sheet (1 sheet(s)) high OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 13 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.microsoft.com/office/spreadsheetml/2014/r

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml
71838ddcadfb5a313886a27570f96beb1572632af952382383b3701aed46cc2d		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 63795 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.