Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 aaa32ff3e41c61fe…

MALICIOUS

Office (OOXML) / .XLSX

155.5 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300
MD5: 08e52afbefa423fb9f1ea0af88a4880e SHA-1: 2d688dfee28f75553bc1d3633f891d2e70e0408b SHA-256: aaa32ff3e41c61fe828f0850e702f5ed7ffd6177c4bf80ed15324525537f44cd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter

The sample is an XLSX file containing multiple Excel 4.0 macro sheets, identified by the OOXML_XLM_MACROSHEET and OOXML_XLSB_INTL_MACROSHEET_IN_XLSX heuristics. These macro sheets are known to be used for executing arbitrary commands. While the specific commands are truncated in the provided evidence, the presence of these macro sheets strongly indicates an intent to run malicious code, likely for downloading and executing a second-stage payload.

Heuristics 2

  • Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX
    OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
071ab5d76ce9ab21f90817d76a426d972884e27bd69cb6ce1815321698b736ce		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.bin 3879 bytes
xlm_sheet_01.bin
f812aed1cdb78fbb53256a600c2c0a9d188330545dcadc46c11cb03b4047d883		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 6541 bytes
xlm_sheet_02.bin
96fb0f7a05938e0827ad19561aa3e88fe4d0434a0f2afbd00caffd48c9207e81		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin 1314 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.