Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 b27b3048288c5f28…

MALICIOUS

Office (OOXML) / .XLSX

70.3 KB Created: 2021-03-15 18:25:06 UTC Authoring application: Microsoft Excel 16.0300
MD5: e7d148a08be2371309ed9bf144b85856 SHA-1: 2ba0793e1cf01a46134ffa268a76199b04f92b12 SHA-256: b27b3048288c5f28f60f84fcf62f953fc4129593a575bc49131c8a501d83d2b4
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The critical heuristic firing indicates the presence of Excel 4.0 macros within the XLSX file. The truncated script content suggests that these macros are designed to download and execute a secondary payload, a common technique for initial access. However, the script is too truncated to reconstruct specific URLs or commands, limiting the IOCs and confidence.

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
cc98201b4b72cb611870c9f270abca4034ab29a76f6f0325286b49aee1e9fb70		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 94320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.