Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 2c36cb4e1771a04e…

MALICIOUS

Office (OOXML) / .XLSM

59.6 KB Created: 2020-12-14 14:30:10 UTC Authoring application: 16.0300
MD5: eb20ca63dc3badc1a48072d33bd6428b SHA-1: 0cdf69cc3fa1612503c82bbb9b947c15e3267ce1 SHA-256: 2c36cb4e1771a04e728d75eb65b05f6875d4eb56df6eb5810af09d0d5e419cd5
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell T1204.002 Malicious File

This XLSM file contains Excel 4.0 macros, indicated by the presence of `xlm_sheet_00.xml` and `xlm_sheet_01.xml`. The critical heuristic `OOXML_XLM_DANGEROUS_FN` firing on `RETURN()` and `xr!C10()` suggests these macros are used to call Win32 APIs for payload execution. The VBA code in `macros.bas` further supports this by containing functions like `Decrement` and `Run` which are likely involved in deobfuscating and executing the payload. The `OOXML_XLM_AUTOOPEN_DEFINEDNAME` heuristic indicates an auto-execution mechanism is present.

Heuristics 6

  • Excel 4.0 macro sheet (2 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: RETURN critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 2 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
cd33def2ab6905cd9c735d12795c364d5135ffd7114afd5b9b039cbbcd7b2aec		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1799 bytes
vbaProject_00.bin
62df3a58802aec155980332ce97e6015f21bc8a735e2ff0a72547e29758c246d		 vba-project OOXML VBA project: xl/vbaProject.bin 19968 bytes
xlm_sheet_00.xml
fe40f758323e95a395710001c3682927a742bfa916e8f45fd540b4bf3bc16c79		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1152 bytes
xlm_sheet_01.xml
dd1747c5673add22df04980e6ac3ef7409f3f054fa848e9c3c68e33c10ccab21		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 990 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.