Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 b402a3128b9526a6…

MALICIOUS

Office (OOXML) / .XLSX

271.9 KB Created: 2021-08-16 09:36:27 UTC Authoring application: Microsoft Excel 12.0000
MD5: 9584cb8b99a3b196bb35176329c86c12 SHA-1: 7bf6be086b50604eae40ec51bd6bdcc73cfc0143 SHA-256: b402a3128b9526a670ce9e7d725fd5875c809d51e3e51036eb36722e7c59ee0d
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel file containing Excel 4.0 macros. The macros are heavily obfuscated and truncated, making it impossible to determine the exact payload or download URL. However, the presence of Excel 4.0 macros strongly suggests an attempt to download and execute a secondary payload.

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
599fa7039e5f5aed1c8551522848f670d0f2e0c505b45aeaf3188bb6bc8def44		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 1101015 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.