Office (OOXML) / .XLSM malware analysis — malicious · aa7d0e46fcbfbc62

MALICIOUS

Office (OOXML) / .XLSM

182.3 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: 00e0c2094cbed4f3660b6e11d08da6d5 SHA-1: 791a34d8fea5ca0d6995e0a537f1fb0fd1d11760 SHA-256: aa7d0e46fcbfbc62880de9148da76de9fef6e1d3e66e360883a580d0e81026ed

310 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter T1071.001 Application Layer Command and Scripting T1566.001 Phishing T1071.002 Application Layer Targeting

The file's verdict, combined with the critical heuristic firings, points to a downloader utilizing the Excel 4.0 XLM macro format. The presence of dangerous formula APIs (CALL, EXEC, REGISTER, FORMULA) and WinAPI strings (URLDownloadToFileA, ShellExecuteA) confirms the intent to download and execute a payload. The hidden sheets likely serve to conceal the malicious macro code. The URLs, while mostly benign, are consistent with the expected behavior of a downloader. The file's age (2015) aligns with historical trends of XLM-based malware campaigns.

Heuristics 7

Excel 4.0 macro sheet (10 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Dangerous XLM formula APIs: FORMULA, GOTO, REGISTER, HALT critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS

Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.
ClamAV: Xls.Downloader.GreenEnable06210-9869360-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.GreenEnable06210-9869360-0
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.xml` `8efd8094f7abd413303db6cd3bd761c2c5950f28478c2dbf981b14155d7123ac`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml	3220 bytes
`xlm_sheet_01.xml` `115d37a2938cb1eb4be3e1f7e040d86a710d0daac1aec0070cce28dd691c49a9`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml	1785 bytes
`xlm_sheet_02.xml` `80e7e10992a865accecd248154f8993955ab288b63e292c3a068867b798fbb33`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml	2651 bytes
`xlm_sheet_03.xml` `f788ff07287f4345ebde979af2962d950f9ee51261be208600834f863e989264`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml	1730 bytes
`xlm_sheet_04.xml` `68030b89e6b4fa9175100e8b7d910608eca541d5ed4e2c0d66aeda37c494a807`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml	1551 bytes
`xlm_sheet_05.xml` `4ebc5cb27ec4f2b547e1bd53bb611ec7d1683658b8c563ab084965c604bd18ef`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml	1550 bytes
`xlm_sheet_06.xml` `02c5359e6c25391c9e987c378ea1fa498b510bbd77700855700c1f66d26cff91`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml	1551 bytes
`xlm_sheet_07.xml` `0a36b8963427a06b07b518fde39e338399acae8b0375228e5cec6bdc4a42f657`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml	1553 bytes
`xlm_sheet_08.xml` `98386f020be407140630c7a14a4e79f58808acc942ac53553e969d84e0686ded`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml	1551 bytes
`xlm_sheet_09.xml` `e01811d7a24b25854e73f639fca1d02c34e5e3943023cd0c3b52664322cf12e5`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	1703 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.