Office (OOXML) / .XLSX malware analysis — malicious · 995b79b392f77625

MALICIOUS

Office (OOXML) / .XLSX

94.2 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 16.0300

MD5: 769c8dac63b99144fbe89aa826a2b639 SHA-1: 8defab0d167b882dac70ac1c0bd1ddd96cbe4e4a SHA-256: 995b79b392f776256fae8b08ad1db073bbd5c369ca8c282999f1e85fd48c340c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications

The file is an XLSX document containing two embedded Excel 4.0 macro sheets. These macro sheets are known to be used for executing malicious code. The heuristics indicate the presence of these macro sheets, which are a strong indicator of malicious intent. The scripts section shows obfuscated XLM macro code, suggesting it's designed to run commands or download further payloads.

Heuristics 2

Excel 4.0 macro sheet (2 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX

OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `3f8db13af710fc4012ee5afb18ac21606b10f6307f1ca1192d9c191e0487c25b`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin	9034 bytes
`xlm_sheet_01.bin` `f697ee5ed6aa2dc2333e560eda58b21fd0a9b4315f1cc12bcc32630116f57256`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin	1176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.