Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 968278e0bd31a649…

MALICIOUS

Office (OOXML) / .XLSX

72.9 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 16.0300
MD5: 3ab9cf4d043027eae77763f1addd41af SHA-1: 753abe817ad3a4b2c5cb71ea139924ac1179e6f1 SHA-256: 968278e0bd31a649e48f01fa8eac1291d41a5015dfcfed6ad45739a181a50b40
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications

The sample is an XLSX file containing embedded Excel 4.0 macro sheets, identified by the OOXML_XLM_MACROSHEET and OOXML_XLSB_INTL_MACROSHEET_IN_XLSX heuristics. This technique is commonly used to execute arbitrary code, often for downloading and running a second-stage payload. The macro content itself is heavily truncated and obfuscated, preventing a more detailed analysis of its specific actions or IOCs.

Heuristics 2

  • Excel 4.0 macro sheet (2 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX
    OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
0ea4d656050be4b1084d24b7a372d65b8c2797b75da270a52e75f02a2f0e92fd		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 48281 bytes
xlm_sheet_01.bin
4e522c536aeccc71c0841e52ecdb22b6de1ec3e24a3582bf9af9daf070713bec		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin 28120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.