Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 f1332a3c5e93b14d…

MALICIOUS

Office (OOXML) / .XLSX

134.5 KB Created: 2021-08-16 09:36:27 UTC Authoring application: Microsoft Excel 12.0000
MD5: e683f8ac796076ba2b6c8960ce298c98 SHA-1: f3aaa27073e6920c565d2b5e8093924ea4f88a10 SHA-256: f1332a3c5e93b14d9e9917409220794fb35e7828a2cc18f46ba30d0be2dff993
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel file containing Excel 4.0 macros, indicated by the OOXML_XLM_MACROSHEET heuristic. The macrosheet content is heavily truncated and obfuscated, preventing a detailed analysis of its specific actions. However, the presence of Excel 4.0 macros strongly suggests an intent to execute commands or download further payloads.

Heuristics 1

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
0ee8ac58843957cff98f3e716ef9f0e28e7554588059ac3bc61b856b6e47731a		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 606784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.