MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059.001 PowerShell
The critical heuristic firing for 'OOXML_XLM_MACROSHEET' indicates the presence of Excel 4.0 macros. Analysis of the 'xlm_sheet_00.bin' content reveals commands that construct paths like 'C:\Users\Public\ngs.txt' and 'C:\Users\Public\ngs.dll'. It also shows the use of 'certutil.exe' to decode a file and 'rundll32.exe' to execute a DLL, suggesting a download and execution chain. The VBA macros are present but truncated, preventing a full analysis of their specific actions.
Heuristics 2
-
Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
-
VBA project inside OOXML medium OOXML_VBADocument contains vbaProject.bin — VBA macros present
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas7aa4187706b7003a52de6699ad5a674e6d1dfb6921f74ab806ef136961c522e6 |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 2610 bytes |
vbaProject_00.bina1f6e466940ef460528067345798237ed185ae05caf8f6c82185138081665737 |
vba-project | OOXML VBA project: xl/vbaProject.bin | 23040 bytes |
xlm_sheet_00.binc793a285c4dad4be43c75d6b40d6fcb36933aeabb2c2a05f8246e4c3ae9713ac |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.bin | 1903 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.