Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 c132e1dd6735d4e8…

MALICIOUS

Office (OOXML) / .XLSM

30.4 KB Created: 2021-03-02 09:04:20 UTC Authoring application: 16.0300
MD5: d64258e28b12c2aee67bb91364f7ace7 SHA-1: ed37621c94e9b060c5cb35aeb6b8aeb70876672d SHA-256: c132e1dd6735d4e849ad4670fb3ef2c351c96a53ad508b9ddf5517328066fed7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is an XLSM document containing VBA macros and Excel 4.0 macro sheets, indicating a macro-based execution technique. The presence of hidden sheets is a common tactic to conceal malicious code. While the VBA code is obfuscated, the structure suggests it's designed to execute further stages, likely involving downloading and running additional payloads. No specific IOCs like URLs or hashes were directly extracted from the provided evidence.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 2 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
3942f1b7912f38fe8ec4385d56db234fa88f9c56843e1a175049c79e25eaf6c6		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2381 bytes
vbaProject_00.bin
4d5b7f775ba3b0402233f25969b9927e3b2714449ba93bf0c0a4dc52285e69e0		 vba-project OOXML VBA project: xl/vbaProject.bin 25088 bytes
xlm_sheet_00.xml
6a391656549201c887614cde60218159fa7da164fd87c00b12dd24200c865d3e		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 865 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.