Office (OOXML) / .XLSX malware analysis — malicious · ba4711d1955de807

MALICIOUS

Office (OOXML) / .XLSX

42.1 KB

MD5: 423f5f5defe4563e4880c17b05473555 SHA-1: aea00a3f85db7bde367ae53f0f7e313e1a2e5aa4 SHA-256: ba4711d1955de80712532f95d220a700c01b060504334f371ad0e6df18291dc6

130 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is an OOXML file containing multiple Excel 4.0 macro sheets. Heuristics indicate the use of dangerous XLM formula APIs like FORMULA, which can call directly into Win32 functions. The embedded XLM macros likely attempt to download and execute a second-stage payload. The specific URLs extracted are benign schema definitions, and no direct malicious URLs or hashes were found in the provided snippets. The confidence is high due to the clear presence of dangerous macro functionality.

Heuristics 4

Excel 4.0 macro sheet (7 sheet(s)) critical OOXML_XLM_MACROSHEET

Malformed OOXML local headers contain an Excel 4.0 (XLM) macro sheet. XLM was a major Office malware vector during 2020-2022 and is rarely used in modern legitimate workbooks.
Dangerous XLM formula APIs: FORMULA critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA).
Malformed OOXML package with recoverable local headers low OOXML_MALFORMED_ZIP_LOCAL_HEADERS

The OOXML ZIP central directory is invalid or missing, but local file headers expose a recoverable Office package. This can create parser divergence between tolerant Office/ZIP readers and scanners that rely only on the central directory.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_07.xml` `845190ff95687dd3bed60f8155a4703d187c9ac3d57c95b5f1e5fbccfcda8bf1`	xlm-macrosheet	Malformed OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml	3818 bytes
`xlm_sheet_08.xml` `eb8dc692c1dd2153c89791e81ba8dde6872cd513333852aece5cf5246e9e9be7`	xlm-macrosheet	Malformed OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	1339 bytes
`xlm_sheet_09.xml` `a2c24226987a123df54bf20bea623cddda5aa0848671b3a68fae646b034b0c13`	xlm-macrosheet	Malformed OOXML XLM macro sheet: xl/macrosheets/sheet2.xml	1334 bytes
`xlm_sheet_10.xml` `1afc49d1079b956e7cd6c79b3050d7c6146176d5f88b0641a059978149dc558f`	xlm-macrosheet	Malformed OOXML XLM macro sheet: xl/macrosheets/sheet3.xml	1337 bytes
`xlm_sheet_11.xml` `f2beecaf3836e6877dc1d8dcccc0ec6a61ee971bb99fad7ea199d9c4485833ad`	xlm-macrosheet	Malformed OOXML XLM macro sheet: xl/macrosheets/sheet4.xml	1341 bytes
`xlm_sheet_12.xml` `33833c2bb127cd3da704c0fa39beca9ede4ef247ba80706d40a7c8cb5fdddbee`	xlm-macrosheet	Malformed OOXML XLM macro sheet: xl/macrosheets/sheet5.xml	1256 bytes
`xlm_sheet_13.xml` `9600e9bf835b635afc1c3dbd6b85e16bd1c645dbab403a3c6d8610cff36b8262`	xlm-macrosheet	Malformed OOXML XLM macro sheet: xl/macrosheets/sheet6.xml	1177 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.