Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 1a7c3fad4f3fabcb…

MALICIOUS

Office (OOXML) / .XLSM

100.1 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300
MD5: 4936b5c18747c6bb0ed7924f1cf6f5a7 SHA-1: 740dc07683c191e01c36ee74b205a8d5926fa69f SHA-256: 1a7c3fad4f3fabcbeef7c8c43dd76ad8dedf55c2631ce666fc1820609d12b0e3
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1071.001 Web Protocols

The sample is an XLSM file containing a Workbook_Open VBA macro. This macro constructs and executes commands to download and run files from several IP addresses, including http://190.14.37.89/, http://74.119.195.114/, and http://212.64.44.229/. The macro also attempts to execute local files named Popol.gors, Popol.gors1, Popol.gors2, Popol.ocx3, Popol.ocx4, and Popol.ocx5 using 'regsver32' with the '-silent' flag, indicating a downloader or dropper functionality.

Heuristics 6

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • ClamAV: Xls.Downloader.Docusign112101-9908076-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Docusign112101-9908076-0
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://190.14.37.89/
    • http://74.119.195.114/
    • http://212.6.44.229/
    • http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
3c3e714d9cd7fb9b9e788b237ef8495032fc0fb331e3cfb5d84c959aa88aa850		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2651 bytes
vbaProject_00.bin
438634a363cc6eaaf56e5e24b297454fb9cac2470c59c18edb28823c90a95331		 vba-project OOXML VBA project: xl/vbaProject.bin 12288 bytes
xlm_sheet_00.xml
e47a1bb05005baa6c77d44783526fc711a37f6dacba438304270e1475494804a		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 3426 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.