Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 26de72fce235aa12…

MALICIOUS

Office (OOXML)

62.5 KB Created: 1999-10-06 07:43:22 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-05-26
MD5: d5225a57b20a9cdecebe779b5406e94a SHA-1: 96dbbe18203b4a7b56daabeaa75adb074d10d311 SHA-256: 26de72fce235aa120caed52dc770a6abfd4b9418dc253afe8ee840ae04b7c3d6
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains critical heuristics for VBA and Excel 4.0 macros, indicating the presence of malicious code. The Auto_Open and Auto_Close macros suggest immediate execution upon opening and closing the document. While no specific download URLs were extracted, the presence of these macros strongly implies the execution of a secondary payload, typical of macro-based malware.

Heuristics 5

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 15021 bytes
SHA-256: dc30d79dffac570ea624dd918984ee3668c40eb170356f0adc74a4562a516d0f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Blad1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub CommandButton1_Click()

End Sub

Private Sub cmdCopyReport_Click()

    Makro1
    'KopieraBlad
 '   Sheets("Blad1").Activate
  '  Sheets("Blad1").Select
  '  Sheets("Blad1").Copy
    
  '  ActiveSheet.Copy
End Sub

Private Sub cmdNewNumber_Click()

    LoadProvider
    
End Sub

Private Sub cmdPrintAll_Click()

    UtskriftSkarvikBlandaLab
    
End Sub

Private Sub cmdPrintLab_Click()

    UtskriftLab
    
End Sub

Private Sub cmdPrintSkarvik_Click()

    UtskriftSkarvik
End Sub

Private Sub Worksheet_SelectionChange(ByVal Target As Excel.Range)

End Sub

Sub makeInvisible()

    cmdNewNumber.Visible = False
    cmdPrintAll.Visible = False
    cmdPrintLab.Visible = False
    cmdPrintSkarvik.Visible = False
    
End Sub

Sub makeVisible()

    cmdNewNumber.Visible = True
    cmdPrintAll.Visible = True
    cmdPrintLab.Visible = True
    cmdPrintSkarvik.Visible = True
    
End Sub

Sub KopieraBlad()

    On Error Resume Next
    makeInvisible
    Sheets("Blad1").Select
    Sheets("Blad1").Copy
    makeVisible

End Sub

Attribute VB_Name = "Modul1"
Public rad As String
Public SampleId As String
Public Chemist As String
Public Nom_Number As String
Public Spec_Code As String
Public LineBlend As String
Public Spec_Desc As String
Public Tank As String
Public Order_Comment As String
Public TestType(1 To 50) As String
Public Result(1 To 50) As String
Public Unit(1 To 50) As String
Public TestOK(1 To 50) As Boolean
Public SampledTime As String
Public RefMethod(1 To 50) As String
Public Description As String
Public NumTests As Integer
Public numTPORes As Integer
Public numRes_ThisString
Public TempString As String
Public Judgement As Boolean
Public JudgeRes_1 As String
Public JudgeRes_2 As String
Public sConnect As String
Public dfwConn As ADODB.Connection
Public datQues As Recordset
Public datSample As Recordset
Public mySQL As String
Public myRow As Integer
Public myCol As Integer

Sub Auto_Open()

    Dim LimsBar         As CommandBar
    Dim LimsCommand     As CommandBarButton

    On Error Resume Next
'
'.... Set up the new toolbar
'

  '  If LimsBar Is Nothing Then
  '  Set LimsBar = CommandBars("Worksheet Menu Bar")
  '  LimsBar.Visible = True
    
  '  Set LimsCommand = LimsBar.Controls.Add
  '  With LimsCommand
  '      .Style = msoButtonCaption
  '      .Caption = "K&opiera rapport"
  '      .BeginGroup = True
  '      .Tag = "Copy Report"
  '      .OnAction = "blad1.KopieraBlad"
  '
  '  End With

   ' End If

    Call LoadProvider
    
End Sub
Sub Row_Height()
'


'
    Range("A12:E65").Select
    With Selection.Font
        .Name = "Arial"
        .Size = 10
        .Strikethrough = False
        .Superscript = False
        .Subscript = False
        .OutlineFont = False
        .Shadow = False
        .Underline = xlUnderlineStyleNone
        .ColorIndex = xlAutomatic
    End With

    Rows("49:62").Select
    Selection.Delete Shift:=xlUp
    Rows("12:51").Select
    Selection.RowHeight = 14
    Range("A1").Activate
    
    
End Sub

Sub Row_Height2()

    Range("A12:E65").Select
    With Selection.Font
        .Name = "Arial"
        .Size = 10
        .Strikethrough = False
        .Superscript = False
        .Subscript = False
        .OutlineFont = False
        .Shadow = False
        .Underline = xlUnderlineStyleNone
        .ColorIndex = 
... (truncated)
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 41984 bytes
SHA-256: e444392e44f7d3ea325fb69c657d4e99219598e6bb8c417034804802e3e7ad0c
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 794 bytes
SHA-256: fa02685bab0dd43e8cea2885be7afa9fece1027fafde09eb779969b954f495dd
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="A1"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="12.75" x14ac:dyDescent="0.2"/><sheetData/><phoneticPr fontId="0" type="noConversion"/><pageMargins left="0.75" right="0.75" top="1" bottom="1" header="0.5" footer="0.5"/><headerFooter alignWithMargins="0"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.