A Clean-Scanned .xls With an Executable Hidden Inside

Three mailboxes at a Cayman Islands-based commercial and investment conglomerate received the same message, among them a project accounts assistant in the commercial department. The subject was a document reference code followed by the sending company's name and its jurisdiction. The body was short and businesslike, closed by a polished signature block with a real street address and phone extension. Six hyperlinks sat inside that signature. One attachment sat below it, a legacy .xls spreadsheet a little over 178 KB.

Nothing about the message read as an attack. It came from a genuine, publicly listed Cayman Islands business, on that company's own domain, through its own Google Workspace tenant. Every authentication check passed. Every link scanned clean. The attachment scanned clean too.

Then a deeper static pass through the spreadsheet's bytes found a Windows PE header and a ZIP archive signature inside it.

Authentication Was Never the Weak Point

Walk the headers and there is no seam to pick at. SPF passed. DKIM passed with a valid signature for the sending company's own domain. ARC passed across the hop chain. Composite authentication came back as a pass (compauth=pass reason=109). The mail went from Google Workspace infrastructure, with a PTR-consistent sending host, straight into the recipient's Microsoft 365 and Exchange Online Protection stack, with no third-party relay, content-disarm gateway, or redirector in between to muddy alignment.

The one soft spot is instructive rather than exploitable. DMARC resolved as a best-guess pass, meaning the sending domain publishes no explicit policy and the receiving side inferred alignment from the SPF and DKIM results instead. That is a governance gap on the sender's side, not an attacker's trick, but under RFC 7489 a domain with no published policy gives receivers nothing to enforce.

The domain itself was clean on every reputation axis a defender would check. Registered since 2020, roughly four years before this message, registrant behind a standard privacy proxy, mapped to a real industrial and import business with a public web presence. Not a lookalike, not a typosquat, not a fresh registration. The likelier reading is a compromised or repurposed mailbox at a legitimate company, the pattern behind vendor email compromise, where the attacker inherits years of sending reputation for free.

A Spreadsheet With Two Extra File Headers Inside

The attachment was a legacy binary Excel file, application/vnd.ms-excel, in the older OLE/BIFF container format, not the modern zipped XML one. At scan time the file verdict was clean. No known-bad signature matched, and no Auto_Open or object-creation strings surfaced in the plain-text pass.

Deeper static inspection told a different story. Inside the same file, analysts recovered an MZ signature, the magic bytes that begin a Windows portable executable, and a PK\x03\x04 local file header, the marker that begins a ZIP archive. PNG stream markers (IHDR, IDAT) were present too. One file was carrying at least three formats at once. That is a polyglot: bytes that satisfy more than one parser, so the layer a scanner reads determines what it believes the file to be.

The analysis environment had one blind spot worth naming, because it is where surface confidence and real coverage part company. The sandbox lacked an OLE-parsing module, so it could not enumerate the spreadsheet's internal streams, which means macro content could not be conclusively ruled out. Not confirmed absent, never examined. A clean verdict on a container the scanner cannot open is a statement about the scanner, not the file.

See Your Risk: Calculate how many threats your SEG is missing

Six Wrapped Links, All of Them Genuine

The six hyperlinks in the signature block did the opposite of what a defender expects malicious links to do. Every one resolved to something real: the sending company's own website, its Facebook, Pinterest, and Houzz profiles, and a brochure on a public flipbook service. Several arrived pre-wrapped in security-vendor rewriters, a TitanHQ link-protection wrapper and Microsoft SafeLinks. All scanned clean, correctly, because all were benign.

Those links were social proof, not payload. A reputation-weighted verdict does not merely fail to catch this pattern, it gets pulled in the wrong direction by it, because the only hostile object in the message was never a URL. Attachment-borne malware needs advanced malware and URL attack protection that inspects file structure, not just link reputation.

Mapping to MITRE ATT&CK

• T1566.001 Phishing: Spearphishing Attachment covers the delivery, a targeted business-document pretext with the payload carried as a file rather than a link.
• T1204.002 User Execution: Malicious File covers the intended next step, since the embedded content requires a recipient to open the spreadsheet before anything runs.
• The polyglot construction functions as an evasion sub-pattern layered on that delivery: executable and archive content nested inside a document container, so the outer format is what gets inspected.

Indicators of Compromise

Where the Catch Actually Came From

The file layer said clean. The message layer disagreed, and the message layer won. The email was tagged as a suspicious message and all three recipient mailboxes were quarantined shortly after receipt, before the embedded signatures had been recovered. An analyst then reviewed the incident and approved that mitigation manually.

That sequence is the whole point. Signature and sandbox verdicts answer a narrow question about one object. Behavioral judgment asks a broader one: does a legacy binary spreadsheet arriving as a document forward from this correspondent fit the relationship, the recipients, and the pretext? That is the terrain Themis, our Adaptive AI analyst, is built to read, and it is why a human review step matters when a file verdict and message context disagree. Deeper static inspection came afterward and explained what the behavioral flag had already acted on. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and phishing in 15 percent of them. Nothing in this message asked the recipient to distrust it.

The Takeaway

A clean attachment verdict is a scoped result, not an all-clear. It means nothing known-bad matched at the layer that was inspected, and here the layer that mattered, the spreadsheet's internal streams, was never opened.

Three practices follow. Treat legacy binary Office formats from external senders as an anomaly worth flagging on their own, because modern workflows rarely need them. Inspect attachments structurally, checking for format signatures that do not belong in the declared container, rather than trusting extension and wrapper. And keep authentication in its lane: SPF, DKIM, DMARC, and ARC establish which domain sent a message, never whether the mailbox behind it is still under its owner's control. CISA's phishing guidance (https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one) and NIST's definition of phishing (https://csrc.nist.gov/glossary/term/phishing) are useful anchors.