Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 e41b7ee82b6e855d…

MALICIOUS

Office (OOXML) / .XLSX

105.4 KB Created: 2021-10-27 10:31:49 UTC Authoring application: Microsoft Excel 12.0000
MD5: 7abfb2fdd531e090f46540b77a946ff9 SHA-1: a43e021725b733bffa83fa756b2b144c65617bfa SHA-256: e41b7ee82b6e855dd787e05c30ee321b580b0a6b9fb7205051b2562bb9da2c19
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The critical heuristic firing indicates the presence of Excel 4.0 macros within the XLSX file. While the macro content is truncated, the presence of such macros strongly suggests an attempt to download and execute a secondary payload. The specific macro sheet filename is included as an IOC.

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
d2ae4908634559442790fb788b32ffac732f8b6e83f01687272aedc4b2949004		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 4125 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.