Office (OOXML) / .XLSX malware analysis — malicious · c8f72a5f6a462f15

MALICIOUS

Office (OOXML) / .XLSX

255.8 KB Created: 2021-06-16 16:02:11 UTC Authoring application: Microsoft Excel 16.0300

MD5: 91e67094df9bc8b5903b6dfcd9b9213a SHA-1: 964cd88818feae92e5c3656aa0876c7b7e3ca72a SHA-256: c8f72a5f6a462f15582f9424b790a711e8202b5acd234321286c8fb2c883d41c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Service Execution: Service Control Manager T1059.001 PowerShell T1059.003 Windows Command Shell

The sample is an Excel file containing Excel 4.0 macros, which are known for their ability to execute arbitrary commands. The presence of a 'cmd.exe' command within the macro sheet strongly suggests an intent to run system commands. The VBA heuristics indicate the use of CreateObject, often employed for launching external processes. This combination points to a macro-based execution of system commands, likely for downloading or executing further malicious payloads.

Heuristics 3

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `9e89659259cebffc077c0c3f354821b8b144db3260e0928809d1f966839cb6ba`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1847 bytes
`vbaProject_00.bin` `8e04a84ad7e6e4c02317a6f4852df319ed1810487bd26724db1abae676eaf479`	vba-project	OOXML VBA project: xl/vbaProject.bin	17920 bytes
`xlm_sheet_00.bin` `0684ca3dcd4e2e8557843129c78d9fd84a7f048dbbacec64e56f99f7e1fa9b11`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	2162 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.