Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 e904e0e341412166…

MALICIOUS

Office (OOXML) / .XLSX

91.0 KB Created: 2021-02-25 10:09:36 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-06-20
MD5: 2c3beba27a366bc0cdca9311b53bbeb9 SHA-1: 21f6dc1ce6ae5c47e3fbb3f65fdf43deef90f022 SHA-256: e904e0e341412166588dad98db9eed82535f88947d1091ee80dc4e98dce8e64a
60 Risk Score

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 2535 bytes
SHA-256: 733dff4bae87d01094d4500698cc0abb5908234a52eec34a76c776a59435773a
Preview script
First 1,000 lines of the extracted script
�  �  �   @      ��������    �      )           �  %      ��                  & �  �             @   d           � $                                    �  �  %      ��    & �  ����  ,     �  <         �         <     �?  $	        �  �  %      ��    &           ,                              %      ��    &           ,                              %      ��    &           ,                              %      ��    &           ,                              %      ��    &           ,                              %      ��    &   
       ,                              %      ��    &           ,                	,              �?                    B       %      ��    &           ,                              %      ��    &           ,                              %      ��    &           ,                	E              �?  +   Z       �:       �:       �:       �   B �     %      ��    &           ,                
:           '       AJ  @     0 0 : 0 0 : 0 1  @   B ��    %      ��    &           ,                              %      ��    &           ,                
D           1   Z       �Z       �Z       �   Q R Q I      	 B �     %      ��    &           ,                 7           $   #~      :      
�:       �      B �     %      ��    &           ,                              %      ��    &           ,                
:           '       AJ  @     0 0 : 0 0 : 0 5  @   B ��    %      ��    &           ,                              %      ��    &           ,                
D           1   Z       �Z       �Z       �   K S Q F      	 B �     %      ��    &           ,                 @           -   #N      :       �:       �:      
�      B �     %      ��    &           ,                              %      ��    &           ,                
                B 6     %      ��    &           ,                              %      ��    &   !       ,                          	   %      ��    &   #       ,                          
   %      ��    &   %       ,                              %      ��    &   '       ,                              %      ��    &   )       ,                          
   �  � � ��                                                                  @   i���/
 O��  S� 1Č(�JZR��凰>P�O����� O;K� �#�ߟ� �?�����8X�|�     fg%� 'yjB��  R��    S H A - 5 1 2 � B                                                                  �   �� 0ffffff�?ffffff�?      �?      �?333333�?333333�?� .    d   X   X                         r I d 2 %      ��  a�	���G����N�& �

Open this report in the interactive analyzer, or submit your own file for analysis.