Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 d264fe84bc5f1361…

MALICIOUS

Office (OOXML) / .XLSX

1.21 MB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-03-23
MD5: 4ad7883575ee445c6b49a8e05619a30b SHA-1: 80dcf0d6527714a7df352ce426a3d8f2195164de SHA-256: d264fe84bc5f136165a3343b47b490965516252f665db856109b510fd81514b5
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter

The sample is an XLSX file containing multiple Excel 4.0 macro sheets, which are often used to deliver malicious payloads. The presence of these macro sheets strongly suggests an attack pattern involving macro execution. While no specific family is identifiable, the technique is common for initial access.

Heuristics 3

  • Excel 4.0 macro sheet (12 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX
    OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
  • Large OOXML part skipped info SCAN_INCOMPLETE
    One or more high-value OOXML parts exceeded the scanner's per-entry size cap and may not have been fully inspected.

Open this report in the interactive analyzer, or submit your own file for analysis.