Office (OOXML) / .XLSX malware analysis — malicious · ee00c49a80c2ffe8

MALICIOUS

Office (OOXML) / .XLSX

1.14 MB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-04-14

MD5: 3e63c70fa1e75e5e157b3d952c7e0fc4 SHA-1: f1540e0d93ffda8b2526ef606a3873453b27c43b SHA-256: ee00c49a80c2ffe8fa16e046b6001503fc128a8b661119356a7d0327e12ddce0

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 Malicious File

The file is an Excel document containing embedded Excel 4.0 macro sheets, identified by critical heuristics. These macro sheets appear to contain obfuscated commands that reference paths like 'C:\ProgramData', suggesting an attempt to download or stage a payload. The presence of an embedded OLE object further supports the malicious nature of the file. The primary attack pattern involves leveraging Excel's macro capabilities to execute arbitrary code.

Heuristics 3

Excel 4.0 macro sheet (4 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX

OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `01a4dbc6c745b9f1019f4a6bfa101eb46af7a2c5609413c756b599d0c7c35bb4`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	3099136 bytes
`ooxml_oleobject_00_ole10native_00.bin` `a6724425b761391a2288cdb0e402bdc8cf2de9a4e93260c95af92b78344a367e`	ole-package	OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	3072068 bytes
`emf_00.emf` `3f0f6bb70f3d65dcc8d248d78ac320bcc22b1148ea5fdd2c1043065d03460133`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	6144552 bytes
`xlm_sheet_00.bin` `630346be548250ad71b13745b9215bf2b337a0b27020c0efac49d0f4ae9b46f4`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin	528 bytes
`xlm_sheet_01.bin` `be935c55e583d1fa0311f93b257e3f3ff0c7253576877390116762af7410673a`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin	776 bytes
`xlm_sheet_02.bin` `cf2f666cdcd0fb66569e9b2d7b5a7ecdc08a5f919470bf03524500fa55adbb93`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet3.bin	1001 bytes
`xlm_sheet_03.bin` `5deb418a7ceb8e782e03f3988a13104444eb7b76421bce48c02c3905eae001b3`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet4.bin	612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.