Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 e28b1212adc862b9…

MALICIOUS

Office (OOXML) / .XLSM

35.0 KB Created: 2020-06-09 18:28:55 UTC Authoring application: Microsoft Excel 16.0300
MD5: 2f91acd98787a3ccfae98de192c18c8d SHA-1: 581830bc0cee407c5e5a720931522a4c25b2d9f0 SHA-256: e28b1212adc862b9041201c510b3fabd9df344fa24c74529f3dc8d945aa8df6e
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is an XLSM document containing Excel 4.0 macros, which is a high-risk indicator. The presence of a 'Visible LOLBin command execution instruction' heuristic firing suggests that the macros are designed to execute commands, likely to download and run a second-stage payload. Hidden worksheets are also present, which are commonly used to conceal malicious content. The specific nature of the commands executed by the XLM macros could not be fully determined due to the truncated document body, but the overall pattern points to a downloader or initial access stage.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) high OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microso
    • http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml
b56617e56d7c7e2b145b633eed760aab499ff2a6402029ddadd5b8d71b71fa56		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 61998 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.