XLM payload reassembled from CHAR()/split formulas

OOXML_XLM_REASSEMBLED_PAYLOAD

← All detection heuristics · Office

critical OOXML_XLM_REASSEMBLED_PAYLOAD

What it means

WinAPI names, LOLBin commands, or a payload URL were reassembled from per-character CHAR()/string-fragment concatenation inside the macrosheet formulas.

Why it fires

The most evasive Excel 4.0 downloaders never store their payload as a contiguous literal: each WinAPI name, shell command, drop path, or URL is built at runtime by concatenating CHAR(n) calls and one- or two-character string fragments inside the formula token stream (rgce). Literal-bytes and numeric cell-array scanners both miss this. The analyzer parses each formula's rgce, reconstructs the string it builds, and reports it when it resolves to a download/execute kill chain (e.g. URLDownloadToFile, regsvr32, mshta, wmic, a URL). This construct does not occur in benign workbooks.

Other Office heuristics

OLE_VBA_AFFINE_MSI_DOWNLOADER OLE_VBA_AUTOEXEC_FRAGMENTED_SHELL OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN OLE_VBA_BIDIRECTIONAL_MACROCOPY_REPLICATION OOXML_BRAND_LINK_MISMATCH_LURE CVE_2016_7262 POLYGLOT_OOXML_REL_COMMAND OLE_RAW_PCODE_CROSS_DOCUMENT_REPLICATION OLE_VBA_CROSS_WORKBOOK_REPLICATION OOXML_XLM_DANGEROUS_FN OFFICE_DEFAULT_PASSWORD_VBA_DROP_EXEC OFFICE_EMBEDDED_SWF EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE OFFICE_EMBEDDED_MACRO_OBJECT OLE_EMBEDDED_EXE OLE_VBA_EMBEDDED_PE_DROPPER OLE_ENCRYPTED_AND_MALFORMED CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED CVE_2017_11882 OLE_EQUATION_OLE10NATIVE_DOWNLOADER OLE_MTEF_NATIVE_CODE_STUB OLE_EQUATION_OLE10NATIVE_SHELLCODE OOXML_XLM_MACRO_IN_WORKSHEET OLE_XLS5_LAROUX_MACRO_VIRUS