Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 ad9cee4508124675…

MALICIOUS

Office (OOXML) / .XLSX

94.4 KB Created: 2021-02-23 07:30:19 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-03-01
MD5: 74767e071069d33b535a15a8e6d98084 SHA-1: 29d5d3d28790d34e79bcbe2a579c962184c8e3c2 SHA-256: ad9cee450812467571d9816e6d372ce8a3fb14fc303cece2b64d382d4136854a
60 Risk Score

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 4522 bytes
SHA-256: 09f77ce703018412392bf2d2eb678a593afc4391372c592faf5fb89366030104
Preview script
First 1,000 lines of the extracted script
�  �  �   @      ��������    �      C           �  %      ��                  & �  �             @   d           � $    6               6   6           �  �  %      ��    & �  ����  ,     �  <         mL        <     �?  $	        �  �  %      ��    &           ,                              %      ��    &           ,                 �            �   I�  @  #    #     #i    #     #i    #z    #O    #a    #�    #�    #~    #C     @  #-   #�    #n    #Z    #.    #V    #     #g    #     #o          %      ��    &           ,                              %      ��    &           ,                 2               I   @  #    #$    #p    #/         %      ��    &           ,                              %      ��    &   
       ,                             
    @  CT        %      ��    &           ,                 ,               I   @  #    #O    #�         %      ��    &           ,                              %      ��    &           ,                 �            �   I�  @  #,   #m     @  #L   #r    #     #R    #P    #Z    #.    #V    #     #Z    #N    #v    #     #       @  #d   #     #`    #C    #h    #y    #     #"    #b    #*          %      ��    &           ,                 T           A   I=  @  #�   #c     @  #    #0    #     #�    #A    #^    #@          %      ��    &           ,                             
    @  C[        %      ��    &           ,                 D           1   I-  @  #    #k    #     #j    #Z    #N    #B         %      ��    &           ,                              %      ��    &           ,                              %      ��    &           ,                	,              �?                    B       %      ��    &           ,                              %      ��    &           ,                
>           +   Z       �:       �:       �:      	�   B �     %      ��    &           ,                              %      ��    &           ,                
:           '       AJ  @     0 0 : 0 0 : 0 1  @   B ��    %      ��    &   !       ,                              %      ��    &   "       ,                
M           :   Z       �:       �:       �   :      
�:      
�      B �     %      ��    &   #       ,                              %      ��    &   $       ,                
:           '       AJ  @     0 0 : 0 0 : 0 5  @   B ��    %      ��    &   %       ,                              %      ��    &   &       ,                
V           C   Z       �:       �:       �   :       �:      
�:      
�      B	�     %      ��    &   '       ,                              %      ��    &   (       ,                
                B 6     %      ��    &   )       ,                              %      ��    &   +       ,                 �            {   Iw  @  #    #.     @  #    #�    #+    #]    #'    #K    #=      @  #G   #     #X    #w    #:    #J    #3    #|    #f          %      ��    &   -       ,                          	   %      ��    &   /       ,                 2               I   @  #�   #>    #%    #          %      ��    &   1       ,                 �            �   I�  @  #(   #e    #q    #I    #s    #M    #?    #�    #�    #{    #X     @  #
   #=    #|    #'    #K    #�    #     #I    #     #     #	    #F    #     #E      @  #�   #F    #5    #�          %      ��    &   3       ,                             
    @  CD        %      ��    &   5       ,                 8           %   I!  @  #�   #�    #7    #.    ##         %      ��    &   7       ,                          
   %      ��    &   9       ,                 �            �   I�  @  #&   #I    #!    #9    #Q    #U    #X    #w    #;    #F    #�    #.    #X    #8     @  #    #S    #)    #     #K    #�    #.    #�    #�    #t    #4    #}          %      ��    &   ;       ,                 r           _   I[  @  #�   #%    #>    #6     @  #�   #�    #%    #S    #     #     #_    #     #u    #x          %      ��    &   =       ,                             
    @  CW        %      ��    &   ?       ,                 8           %   I!  @  #�   #�    #<    #F    #Y         %      ��    &   A       ,                              %      ��    &   C       ,                              �  � � ��                                                                  @     �v\� �2��n5��]�mw+���2�SQ�c�G��  	S��j* ]�6�/� �Q0=�r�  ��    ��Ǭ�� 	  -#j "�    S H A - 5 1 2 � B                                                                  �  ��� 0ffffff�?ffffff�?      �?      �?333333�?333333�?%      ��  ���� H�@��]꯷dF& �

Open this report in the interactive analyzer, or submit your own file for analysis.