Office (OOXML) / .XLSX malware analysis — malicious · db57111e0d6b84fe

MALICIOUS

Office (OOXML) / .XLSX

181.8 KB Created: 2020-05-03 13:28:15 UTC Authoring application: Microsoft Excel 16.0300

MD5: 3b9d24c3bf61e85fc11fb77a83d82f1a SHA-1: 926a2c5ad9f7ed61d2206cf91256a1b58b640550 SHA-256: db57111e0d6b84fe41af0e9e639a7f566bb2bea3d8afd0c8d98022ee4f5dd41d

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell

The critical heuristic firing indicates the presence of Excel 4.0 macros, a technique often used for obfuscation and initial execution. The VBA script within 'macros.bas' contains functions that save worksheet data to external files named 'Sheet1.xls' and 'Sheet2.txt'. This suggests the macro is designed to extract or prepare data for a subsequent stage of an attack, potentially by dropping a malicious file or configuration. The 'SC_NOP_EQUIV_SLED' heuristic is less specific but can sometimes indicate shellcode or exploit-related activity.

Heuristics 3

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED

Long run of 0x61 bytes
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0aa94a1b93bbea3630733076c312c626131e99497d98750357798d82cc6fa23a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1621 bytes
`vbaProject_00.bin` `dc83426137f3e6c383475c29091c5de891e9d0af4e4c6de3c91f422de6acd66e`	vba-project	OOXML VBA project: xl/vbaProject.bin	16896 bytes
`xlm_sheet_00.bin` `15fc128a7a615f56b5b48dc0a3532d3d28c4cfcc5e44ea591bb751f956e057f6`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	1432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.