Office (OOXML) / .XLSM malware analysis — malicious · 660db63cbeef254c

MALICIOUS

Office (OOXML) / .XLSM

73.9 KB Created: 2020-12-21 13:37:45 UTC Authoring application: 16.0300

MD5: 935c02d3cac9f8290a16ba999ca70727 SHA-1: 7d4e95be0f5c2fe2fd083c2dc884b80f6a939a7a SHA-256: 660db63cbeef254c26a647154c7b057b1906ad65d3d95696597f5a2e2e9e2e08

90 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample is an XLSM file containing both VBA macros and Excel 4.0 macro sheets. The VBA code, specifically the 'mo' subroutine, calls 'Run (Cooper_n & "i")' which likely executes obfuscated code. The Excel 4.0 macro sheet references a formula that calls 's_prints1(2)', suggesting it's part of the execution chain. The reconstructed string 'Acal_i' is likely a dynamically generated name for a macro or function that is executed.

Heuristics 4

Excel 4.0 macro sheet (2 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 2 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `06ab50d4316e40f84a7f49f4073d9faa29e447b7dda9ee1188246af71ee7f386`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1996 bytes
`vbaProject_00.bin` `184f364fac20497f6e02973ffb7d16e66a4c5f9dd62437a06c151756064d5953`	vba-project	OOXML VBA project: xl/vbaProject.bin	19456 bytes
`emf_00.emf` `068b1b5475127332c13ed6c07f9f55ab2bbf3b5b1b0ac4caa9d13171780bc214`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	2024 bytes
`xlm_sheet_00.xml` `6e043719fc874c9adb0f4dab4e97bdf41170ec521539bc80479956f8e8feddbb`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	871 bytes
`xlm_sheet_01.xml` `ea51139098d3e73bf3975544934d9815b7c29fcac93e2fe297adf29fe42d3ace`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.xml	989 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.