Office (OOXML) / .XLSM malware analysis — malicious · 52c0aee9b9ff77ba

MALICIOUS

Office (OOXML) / .XLSM

109.4 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: 038d5ebbac4343a62694150daf23e9dc SHA-1: 7f884b072695a23f0adff2c9333aec56a291a747 SHA-256: 52c0aee9b9ff77ba3579e080302ea115cf784a62d95bcd3892760ab91ea12679

188 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer

This malicious Excel macro-enabled document (XLSM) utilizes Excel 4.0 macros, which are known for their ability to execute arbitrary code and download payloads. The critical heuristics indicate the use of dangerous XLM formula APIs like EXEC and CALL, strongly suggesting the sample attempts to download and run a second-stage payload from the provided URLs. The presence of an Auto_Open macro further supports the immediate execution of malicious code upon opening the document.

Heuristics 6

Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Dangerous XLM formula APIs: HALT, GOTO, REGISTER, EXEC critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 3 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://91.211.91.82/44313,6048108796.dat
- http://82.117.252.199/44313,6048108796.dat
- http://45.138.157.43/44313,6048108796.dat
- http://91.211.91.82/
- http://82.117.252.199/
- http://45.138.157.43/
- http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `19626508773a68d544063e9cd47e5407816d3506d0c5df431dfadcc2ae560644`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	786 bytes
`vbaProject_00.bin` `199889e0394000a2e1581ef295e9f53a3c6d626d9f7063b3c9ef8cf8e3ca63c5`	vba-project	OOXML VBA project: xl/vbaProject.bin	10240 bytes
`xlm_sheet_00.xml` `a3ff78ad476320d5df05f36d29827f0ccf7c95830338250c5be8e68dc7098191`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	4285 bytes
`xlm_sheet_01.xml` `a5fc80b1569128bd0323daacf4b0484b147d9d37755aacc26435ea011bd9f0cd`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.xml	2111 bytes
`xlm_sheet_02.xml` `a6c079d2a564b952bdc7f60d49402489a374e91f07f8b51ef328523d2a650900`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet3.xml	1944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.