MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is an Excel 4.0 (XLM) macro sheet, which is a strong indicator of malicious intent. The document body and heuristics indicate a lure to enable macros by impersonating a document signing service. This is a common technique for macro-based downloaders. No scripts were extracted, but the presence of XLM macros and the document signing lure suggest the primary goal is to trick the user into enabling content to download and execute a secondary payload.
Heuristics 3
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
-
Macro/content-enable lure medium SE_ENABLE_LUREDocument instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
-
Document signing service impersonation lure medium SE_DOCUSIGN_LUREDocument impersonates DocuSign, Adobe Sign, or a similar signing service in a signing-request context
Open this report in the interactive analyzer, or submit your own file for analysis.