Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 f4795507c7b135f7…

MALICIOUS

Office (OOXML) / .XLSX

100.4 KB Created: 2021-06-03 15:24:06 UTC Authoring application: Microsoft Excel 16.0300
MD5: 426493a609fd1fdf4634616b3c70d314 SHA-1: 104cf82b9ad7392d4ce29f6d40d8ea32ab533999 SHA-256: f4795507c7b135f7d3feebc4c9e46f404bdc547d75f2943b3e0d54b5288c5708
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is an Excel spreadsheet containing Excel 4.0 macros, which are known to be used for malicious purposes. The extracted macro code includes a call to `CreateObject` and references `cmd`, indicating an attempt to execute system commands. This is likely used to download and execute a second-stage payload. The VBA code also contains obfuscation techniques, further suggesting malicious intent.

Heuristics 3

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e8a37e6897b47e8a1ade83918882e25425a14f29f9a8d28cfb5483e701f75849		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 654 bytes
vbaProject_00.bin
dbe3e7c2a94115bf47f3359929fc1d64741960d0a809a3401ec713bd2f2b3eae		 vba-project OOXML VBA project: xl/vbaProject.bin 12288 bytes
xlm_sheet_00.bin
683d977acbcbebd0c03904a68fdd591858aad2b3ce753160e50fdec98e50af79		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 2138 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.