Office (OOXML) / .XLSM malware analysis — malicious · 1640d4b0b19b018b

MALICIOUS

Office (OOXML) / .XLSM

182.3 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: dd5e3e3647cc589c125f3f34697d6435 SHA-1: 81dd4c1386c0c2596947e02478618df96f770f6f SHA-256: 1640d4b0b19b018bd400bb40a666497c356318c581bfda7c60d970b5fdec3523

310 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution T1105 Ingress Tool Transfer

This XLSM file contains Excel 4.0 macros that leverage dangerous functions like REGISTER and EXEC to download a payload using URLDownloadToFileA. The macros construct a URL from multiple IP addresses and attempt to download a file, indicating an initial stage of a downloader. The use of Excel 4.0 macros and the specific download functionality points to a macro-based downloader.

Heuristics 7

Excel 4.0 macro sheet (10 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Dangerous XLM formula APIs: FORMULA, GOTO, REGISTER, HALT critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS

Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.
ClamAV: Xls.Downloader.GreenEnable06210-9869360-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.GreenEnable06210-9869360-0
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.xml` `8efd8094f7abd413303db6cd3bd761c2c5950f28478c2dbf981b14155d7123ac`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml	3220 bytes
`xlm_sheet_01.xml` `115d37a2938cb1eb4be3e1f7e040d86a710d0daac1aec0070cce28dd691c49a9`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml	1785 bytes
`xlm_sheet_02.xml` `80e7e10992a865accecd248154f8993955ab288b63e292c3a068867b798fbb33`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml	2651 bytes
`xlm_sheet_03.xml` `f788ff07287f4345ebde979af2962d950f9ee51261be208600834f863e989264`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml	1730 bytes
`xlm_sheet_04.xml` `68030b89e6b4fa9175100e8b7d910608eca541d5ed4e2c0d66aeda37c494a807`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml	1551 bytes
`xlm_sheet_05.xml` `4ebc5cb27ec4f2b547e1bd53bb611ec7d1683658b8c563ab084965c604bd18ef`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml	1550 bytes
`xlm_sheet_06.xml` `02c5359e6c25391c9e987c378ea1fa498b510bbd77700855700c1f66d26cff91`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml	1551 bytes
`xlm_sheet_07.xml` `0a36b8963427a06b07b518fde39e338399acae8b0375228e5cec6bdc4a42f657`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml	1553 bytes
`xlm_sheet_08.xml` `98386f020be407140630c7a14a4e79f58808acc942ac53553e969d84e0686ded`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml	1551 bytes
`xlm_sheet_09.xml` `e01811d7a24b25854e73f639fca1d02c34e5e3943023cd0c3b52664322cf12e5`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	1703 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.