Office (OOXML) / .XLSX malware analysis — malicious · c25f5f86ab2aa492

MALICIOUS

Office (OOXML) / .XLSX

208.2 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-10-21

MD5: 98636e940474f0bebfcc03db617aaf36 SHA-1: 405dfe612512d6a0a04cb1fa8a9bd3238304edec SHA-256: c25f5f86ab2aa4928dbc144a55a92ed5be6558787ac0f450d6411d85076547b7

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file contains Excel 4.0 macro sheets, a known technique for executing malicious code. The macros appear to construct a URL and a DLL path, suggesting a downloader functionality. Specifically, the macro attempts to download a file from 'ralepijo.com/grasbly.dll' and save it as 'C:\Kepofad\Jdvidasja\Fuelavrb.dll', likely to execute a second-stage payload.

Heuristics 1

Excel 4.0 macro sheet (2 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `1af000661addeb594a1654b4f2f1450ce1ad20c48a7872037e9cef61104beda6`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	1795 bytes
`xlm_sheet_01.bin` `66452b63ebe5180ecf0d164134621bcf1abb3655b13fc054ac56728c91ad063d`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.bin	618 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.