Office (OOXML) / .XLSM malware analysis — malicious · d059c455c7ae424b

MALICIOUS

Office (OOXML) / .XLSM

39.6 KB Created: 2020-12-02 13:26:07 UTC Authoring application: Microsoft Excel 16.0300

MD5: d5ca6159b07815635c658cfbfb5d7efa SHA-1: 9bb8486af8728aa71c8fbf79f698cd1fa05aee85 SHA-256: d059c455c7ae424b5e0894f5bba76e445a1c70562eea0367313b7a0e446a125d

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.001 PowerShell T1204.002 Malicious File

This XLSM file contains Excel 4.0 macros that are designed to execute a second-stage payload. The VBA code reconstructs a string 'Au_tv5' which is likely used as a name for a macro sheet or a function. The critical heuristics indicate the use of dangerous XLM functions like RETURN, which can be used to call Win32 APIs for downloading and executing payloads. The presence of a hidden sheet further suggests an attempt to conceal malicious activity.

Heuristics 6

VBA ActiveX event runs worksheet-decoded XLM formulas critical OLE_VBA_ACTIVEX_XLM_CELL_STAGER

VBA code attached to an ActiveX/UserForm event reconstructs formula text from worksheet constants using Split/Replace/Mid or character shifting, then executes it through ExecuteExcel4Macro or Run. This is a high-confidence malware stager that hides XLM formula execution in sheet cells; it is not a document-parser CVE.
Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Dangerous XLM formula APIs: RETURN critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ae317a54700eb2f955a62fd4ce62a46622ceed5880c768abeade8bf5fcaa0b45`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1562 bytes
`vbaProject_00.bin` `53dec7a4f41398076b19c4d78342c480d3e186379c3a03041b041d6325306ef6`	vba-project	OOXML VBA project: xl/vbaProject.bin	17920 bytes
`emf_00.emf` `9a16976c701f6813b7a8d98761299f94e5eca283636006616aebbdd14393fe75`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	1976 bytes
`xlm_sheet_00.xml` `a6be2620306bb3e75f8640581dded02a0dc23080a5d0e5a16fcf818ed7c6c01c`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	957 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.