Office (OOXML) / .XLSX malware analysis — malicious · fdeff5ef285252e1

MALICIOUS

Office (OOXML) / .XLSX

119.8 KB Created: 2021-10-27 10:31:49 UTC Authoring application: Microsoft Excel 12.0000

MD5: 132be77d8dc9a1276d540ca0dac69363 SHA-1: 7d0a818edf65c7d9b94b04e6d2009c28a358c256 SHA-256: fdeff5ef285252e12547e6240a9e59e56ef4c386edc55e9435185c32ae2ee2d3

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The critical heuristic firing indicates the presence of an Excel 4.0 macro sheet. The macro sheet contains obfuscated strings that appear to construct a file path, likely for dropping and executing a malicious payload. The reconstructed path is C:\ProgramData\a\a\a\wLS\fI\Ao\hpe\Ao\u.rt\Ao\f\Ao\B. This suggests a downloader or droppper functionality.

Heuristics 1

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `9a033ac9449b7b62d61a61acbd0c00a1dba06b1bdf3923e95515ca5f60721f97`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	4149 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.