Office (OOXML) / .XLSX malware analysis — malicious · b48ce4c3587d4374

MALICIOUS

Office (OOXML) / .XLSX

119.6 KB Created: 2021-03-29 19:54:41 UTC Authoring application: Microsoft Excel 16.0300

MD5: 6be9301cce390b5ea409f5a760c91f48 SHA-1: 8229c4258205b92a96fb2ba49418924a2b6821e2 SHA-256: b48ce4c3587d437493c30892334b4025e94c74541d3d5a2b195478e93eea0e9c

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample is an Excel file containing Excel 4.0 macros. The heuristic firing indicates the presence of these macros, which are often used to download and execute malicious payloads. The macro content is heavily obfuscated and truncated, preventing a more detailed analysis of its specific actions or IOCs.

Heuristics 1

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `4ba2168210d43affdc2df39a4c02216ffe17c7afee4f75dbc3d4113362e4fe4d`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	96634 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.