Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ad3e705b9d00fcbb…

MALICIOUS

Office (OOXML)

934.6 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2020-12-28
MD5: 5a1df4676cca951566f08ed4b84f34c4 SHA-1: 6e7d623b4f17d9d6099543a8835e8c7e3a44ef9b SHA-256: ad3e705b9d00fcbb29a42719cf02b353a2936d1bfa325b581dac4a7055b9ed86
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The file contains critical heuristic firings indicating the presence of disguised Excel 4.0 macros, including an Auto_Open defined name and WinAPI/download strings. These macros are likely used to download and execute a second-stage payload, as suggested by strings like 'DownloadToFileA' and 'CreateDirectoryA'. The use of disguised relationships and macro sheets points to an attempt to evade detection.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical 3 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 macro sheet stored under disguised package path critical OOXML_XLM_DISGUISED_RELATIONSHIP
    OOXML package declares an xlMacrosheet relationship whose target is outside the canonical xl/macrosheets/ path. Excel follows the relationship type, while path-only scanners can miss the macro execution surface.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS
    Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.

Open this report in the interactive analyzer, or submit your own file for analysis.