Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 eb84e38dcd0c4a90…

MALICIOUS

Office (OOXML) / .XLSX

197.2 KB Created: 2021-02-27 09:36:14 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-06-20
MD5: 97ddf648ac6d7f338d20f0508bef20d2 SHA-1: c51e33389745e6209d5856dcf7045cbab2a6ab08 SHA-256: eb84e38dcd0c4a9001ff77f310fff1f35f7a1f266d427e936e147f2503d7fd4e
60 Risk Score

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 8324 bytes
SHA-256: fe95eeb486c0a16c28e3eab4b527d3bd42d7f6e7bb75290e13a27bc9b568756f
Preview script
First 1,000 lines of the extracted script
�  �  �   @      ��������    �      �           �  %      ��                  & �  �     �       @   d           � $    �                   ��      �?  �  �  %      ��    & �  ����  ,     �  <         ��        <     �?  $	        �  �  %      ��    &           ,                              %      ��    &           ,                 �            %   I!  @  #�   #!     @  #    #,    #�    #x    #�    #�      @  #    #�    #�    #     #�      @  #    #/    #:    #�      @  #    #     #B    #     #7    #8    #6    #�    #�    #     #d    #�    #%    #7    #n    #]    #9    #�    #     #$    #     #�    #k    #     #L    #<    #E    #w          %      ��    &           ,                              %      ��    &           ,                              %      ��    &           ,                              %      ��    &   
       ,                          !   %      ��    &           ,                          "   %      ��    &           ,                 k           X   I1  @  #�   #E    #�    #     #x    #      @  #I     I   @  #�   #&    #     #h     @       %      ��    &           ,                          #   %      ��    &           ,                          $   %      ��    &           ,                              %      ��    &           ,                 �            %   I!  @  #�   #!     @  #    #,    #�    #x    #�    #�      @  #    #�    #�    #     #�      @  #    #/    #:    #�      @  #    #     #B    #     #7    #8    #6    #�    #�    #     #d    #�    #%    #7    #n    #]    #9    #�    #     #$    #     #�    #k    #     #L    #<    #E    #w          %      ��    &           ,                              %      ��    &           ,                              %      ��    &           ,                              %      ��    &           ,                          !   %      ��    &           ,                          "   %      ��    &   "       ,                 k           X   I1  @  #�   #E    #�    #     #x    #      @  #I     I   @  #�   #&    #     #h     @       %      ��    &   $       ,                          #   %      ��    &   &       ,                          $   %      ��    &   (       ,                          %   %      ��    &   *       ,                 �            �   I�  @  #�    @  #-   #'    #�    #l    #�      @  #r   #z    #       @  #J   #>    #�      @  #A   #�    #U    #�    #f      @  #G   #
    #�    #{    #�    #U    #X    #	    #�    #t    #K    #g    #q    #�    #N    #+          %      ��    &   ,       ,                          &   %      ��    &   .       ,                          '   %      ��    &   0       ,                          (   %      ��    &   2       ,                          )   %      ��    &   4       ,                          *   %      ��    &   6       ,                 e           R   I1  @  #�   #*    #=    #�    #l    #s     @  #I     I   @  #�   #�    #h     @       %      ��    &   8       ,                          +   %      ��    &   :       ,                          ,   %      ��    &   <       ,                          %   %      ��    &   >       ,                 �            �   I�  @  #�    @  #-   #'    #�    #l    #�      @  #r   #z    #       @  #J   #>    #�      @  #A   #�    #U    #�    #f      @  #G   #
    #�    #{    #�    #U    #X    #	    #�    #t    #K    #g    #q    #�    #N    #+          %      ��    &   @       ,                          &   %      ��    &   B       ,                          '   %      ��    &   D       ,                          (   %      ��    &   F       ,                          )   %      ��    &   H       ,                          *   %      ��    &   J       ,                 e           R   I1  @  #�   #*    #=    #�    #l    #s     @  #I     I   @  #�   #�    #h     @       %      ��    &   L       ,                          +   %      ��    &   N       ,                          ,   %      ��    &   P       ,                 �            �   I!  @  #W   #p    #S    #>    #Y     Ii  @  #[   #P     @  #�   #Q    #M    #�    #\    #�      @  #M   #�      @  #V   #R    #c    #2    #^      @       %      ��    &   R       ,                          -   %      ��    &   T       ,                          .   %      ��    &   V       ,                          /   %      ��    &   X       ,                          0   %      ��    &   Z       ,                 �            �   I!  @  #W   #p    #S    #>    #Y     Ii  @  #[   #P     @  #�   #Q    #M    #�    #\    #�      @  #M   #�      @  #V   #R    #c    #2    #^      @       %      ��    &   \       ,                          -   %      ��    &   ^       ,                          .   %      ��    &   `       ,                          /   %      ��    &   b       ,                          0   %      ��    &   d       ,                 �            q   I   @  #?   #O     I7  @  #H   #"     @  #    ##    #5    #T    #F    #4      @   I  #@   #;     @  #D   #�          %      ��    &   f       ,                          1   %      ��    &   h       ,                          2   %      ��    &   j       ,                          3   %      ��    &   l       ,                 �            �   I%  @  #3   #�    #     #�     @  #i      @  Co    @   I�  @  #1   #a    #)    #     #C     @  #D   #v    #b    #}    #�      @  #e   #     #_      @  #D   #y    #�    #u      @  #(   #     #|      @       %      ��    &   n       ,                 �            q   I   @  #?   #O     I7  @  #H   #"     @  #    ##    #5    #T    #F    #4      @   I  #@   #;     @  #D   #�          %      ��    &   p       ,                          1   %      ��    &   r       ,                          2   %      ��    &   t       ,                          3   %      ��    &   v       ,                 �            �   I%  @  #3   #�    #     #�     @  #i      @  Co    @   I�  @  #1   #a    #)    #     #C     @  #D   #v    #b    #}    #�      @  #e   #     #_      @  #D   #y    #�    #u      @  #(   #     #|      @       %      ��    &   w       ,                              %      ��    &   y       ,                              %      ��    &   {       ,                              %      ��    &   }       ,                              %      ��    &           ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                              %      ��    &   �       ,                	,             ��@       �      �     B       %      ��    &   �       ,                
>           +   Z  #    �:  &    �:  (    �:  '   	�   B �     %      ��    &   �       ,                              %      ��    &   �       ,                
:           '       AJ  @     0 0 : 0 0 : 0 1  @   B ��    %      ��    &   �       ,                              %      ��    &   �       ,                
D           1   Z  =    �Z  ?    �Z  E    �   P J K W      	 B �     %      ��    &   �       ,                 7           $   #�      :  C   
�:  @    �      B �     %      ��    &   �       ,                              %      ��    &   �       ,                
:           '       AJ  @     0 0 : 0 0 : 0 5  @   B ��    %      ��    &   �       ,                              %      ��    &   �       ,                
V           C   Z  7    �:  <    �:  ?    �   :  :    �:  <    �:  >    �      B	�     %      ��    &   �       ,                              %      ��    &   �       ,                
                B 6     �  � � ��                                                                  @   ����H�
@� �9ɐX٘Lk�4z����� AEq-L �'gO �� �T  	�� op_�7 �N ����     ���IllI �6�v��u    S H A - 5 1 2 � B                                                                  �   @� 0ffffff�?ffffff�?      �?      �?333333�?333333�?� .    d   X   X                         r I d 2 %      ��  ۇ /'��C�4��) i�& �