Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 98eed23a08893158…

MALICIOUS

Office (OOXML) / .XLSX

124.3 KB Created: 2021-03-29 19:54:15 UTC Authoring application: Microsoft Excel 16.0300
MD5: 3c35a42ba9e00861c71e82c8b4be60d1 SHA-1: 76fdbb98051aef769eba631cfa69702d7157863c SHA-256: 98eed23a08893158e4152db923bbc033a0090c68012ac1f41ad75a0914696c2f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications

The primary finding is the presence of an Excel 4.0 macro sheet, indicated by the OOXML_XLM_MACROSHEET heuristic. While the macro content is truncated and heavily obfuscated, this technique is commonly used to execute arbitrary code or download secondary payloads. The exact functionality and IOCs cannot be determined due to the truncated nature of the script.

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
d949a8b7ffa97589188bab8170d521758076d1b4c068e080055a6adbc7dea520		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 98782 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.