Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 ee6eaa829ef89396…

MALICIOUS

Office (OOXML) / .XLSX

182.3 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300
MD5: 3e53db5d8b3f822197726fa964f03fac SHA-1: 624cc028145526ff52ffe4088e4281d9a8292a2c SHA-256: ee6eaa829ef89396356f2d6652c0bba611d42f04e1e5a3b8edadc35c5449d217
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel file containing multiple Excel 4.0 macro sheets, including an Auto_Open defined name, which is a common technique for initial execution. The macros utilize dangerous XLM formula APIs like FORMULA, GOTO, REGISTER, and HALT, and contain strings indicative of downloading payloads such as URLDownloadToFileA and DownloadToFileA. This strongly suggests the file's purpose is to act as a downloader for a second-stage malicious payload.

Heuristics 7

  • Excel 4.0 macro sheet (10 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, GOTO, REGISTER, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS
    Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.
  • ClamAV: Xls.Downloader.GreenEnable06210-9869360-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.GreenEnable06210-9869360-0
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml
8efd8094f7abd413303db6cd3bd761c2c5950f28478c2dbf981b14155d7123ac		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 3220 bytes
xlm_sheet_01.xml
115d37a2938cb1eb4be3e1f7e040d86a710d0daac1aec0070cce28dd691c49a9		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 1785 bytes
xlm_sheet_02.xml
80e7e10992a865accecd248154f8993955ab288b63e292c3a068867b798fbb33		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml 2651 bytes
xlm_sheet_03.xml
f788ff07287f4345ebde979af2962d950f9ee51261be208600834f863e989264		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml 1730 bytes
xlm_sheet_04.xml
68030b89e6b4fa9175100e8b7d910608eca541d5ed4e2c0d66aeda37c494a807		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml 1551 bytes
xlm_sheet_05.xml
4ebc5cb27ec4f2b547e1bd53bb611ec7d1683658b8c563ab084965c604bd18ef		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml 1550 bytes
xlm_sheet_06.xml
02c5359e6c25391c9e987c378ea1fa498b510bbd77700855700c1f66d26cff91		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml 1551 bytes
xlm_sheet_07.xml
0a36b8963427a06b07b518fde39e338399acae8b0375228e5cec6bdc4a42f657		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml 1553 bytes
xlm_sheet_08.xml
98386f020be407140630c7a14a4e79f58808acc942ac53553e969d84e0686ded		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml 1551 bytes
xlm_sheet_09.xml
e01811d7a24b25854e73f639fca1d02c34e5e3943023cd0c3b52664322cf12e5		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1703 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.