MALICIOUS
250
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic for Applications
T1204.002 Malicious File
This XLSM file contains multiple Excel 4.0 macro sheets, including an Auto_Open macro, which is a common technique for initial execution. The macros utilize dangerous functions like FORMULA, GOTO, and HALT to directly call Win32 APIs, enabling the download and execution of a second-stage payload. ClamAV identified the sample as Xls.Downloader.IcedID, suggesting this family.
Heuristics 6
-
Excel 4.0 macro sheet (6 sheet(s)) critical OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
-
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAMEWorkbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
-
Dangerous XLM formula APIs: FORMULA, GOTO, HALT critical OOXML_XLM_DANGEROUS_FNExcel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
-
ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
-
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEETExcel workbook contains 6 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6
Extracted artifacts 6
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_00.xmle26278d9df62929caddc39c2675d1a93c805965a35896b4c4240468b728373e2 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml | 1190 bytes |
xlm_sheet_01.xmlb0c92abb60a2275195a7039b8d0c793da46292b6cf2282abe16347418f199576 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml | 3195 bytes |
xlm_sheet_02.xml60860e3e942fc249672c3f297fa7f4b06db5f5d49d084784eafb2c3e4889ad39 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml | 2298 bytes |
xlm_sheet_03.xmlf6023b616a33da16850bd04bca335ab61b8bf9717cbe0a8ef91527cea67ae7fd |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml | 2025 bytes |
xlm_sheet_04.xmld60ca3a864e3f818e7a00f9aa3f6fdbc180e13ef9ef26c0d3de35bf633fcfa97 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml | 1560 bytes |
xlm_sheet_05.xmldd9efeb7c324f68d06e9a7e99610df77ef935e2fc86a64fc3a473904f7bcfe45 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.xml | 1821 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.