Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 28cf4c3a7f9ebb50…

MALICIOUS

Office (OOXML) / .XLSM

94.7 KB Created: 2020-06-07 16:41:23 UTC Authoring application: Microsoft Excel 14.0300
MD5: 1633b25e8a1b6ffd5813bd496a9f9761 SHA-1: 8e4cad3316a84ed32ee582bf7214d0f53e4bbc45 SHA-256: 28cf4c3a7f9ebb50e946382010448e7662848b6e512c001c6da3c1466dcf22e9
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.011 System Binary Proxy Execution: Rundll32 T1105 Ingress Tool Transfer T1059.003 Windows Command Shell

The sample is an XLSM file containing Excel 4.0 macros, a known technique for malware delivery. The macros appear to be designed to download a DLL from 'https://onallyblo.at/3/gbs.dll' and register it using 'regsvr32.exe' or 'rundll32.exe'. The presence of hidden sheets and the use of LOLBins like regsvr32.exe further indicate malicious intent. The reconstructed URL and DLL path are included as IOCs.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) high OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 21 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://onallyblo.at/3/gbs.dll

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml
40eafc133acdcae7071837c7369a3711e88bdae9bd6965faecb630b8d1ec9d5b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 38094 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.