Office (OOXML) / .XLSX malware analysis — malicious · d3cde2540e2479a1

MALICIOUS

Office (OOXML) / .XLSX

111.9 KB Created: 2021-10-27 10:31:49 UTC Authoring application: Microsoft Excel 12.0000

MD5: e18891dd591393ff5d3d07117747a184 SHA-1: f60c552a6207e6499def5159bb2adc9846ee5a22 SHA-256: d3cde2540e2479a1ee5bca3942e34fd9983b4757f2a8006c8c4eb8e4157fea01

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is an Excel 4.0 macro sheet, a known method for executing malicious code within Office documents. The macro sheet appears to be attempting to construct a path related to Microsoft Office, potentially to locate or modify application files. However, the script content is heavily truncated and obfuscated, preventing a definitive analysis of its exact payload or execution method. Further analysis would be required to determine the full scope of its malicious activity.

Heuristics 1

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `590ba973a9ef0751a4d7d24a501c7f65b9ef0fc02a67f3748c98867622dd8fb9`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	318877 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.