MALICIOUS
190
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file contains Excel 4.0 macros, indicated by multiple critical heuristic firings including 'OOXML_XLM_MACROSHEET' and 'OOXML_XLM_DANGEROUS_FN'. These macros are designed to download and execute a second-stage payload from the reconstructed URL 'http://185.8.1.115.23/ytr.dll' to the path 'C:\Datop\test.test'. The use of dangerous XLM functions like FORMULA and FORMULA.FILL directly facilitates this malicious activity.
Heuristics 5
-
Excel 4.0 macro sheet (8 sheet(s)) critical OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
-
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAMEWorkbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
-
Dangerous XLM formula APIs: FORMULA, FORMULA.FILL critical OOXML_XLM_DANGEROUS_FNExcel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
-
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEETExcel workbook contains 11 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6
Extracted artifacts 8
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_00.xmlf59fa88f2d194a4d340877876ab75cc4a85d08cdb88ed243399864daf048c02e |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml | 2884 bytes |
xlm_sheet_01.xml68031f6c02089036adf57e2ef01d881dabf389a96bb176fb86695c0fb7deda50 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.xml | 1277 bytes |
xlm_sheet_02.xml523d7bbd4547bd1e2a997ca4f87318b3e43146ca792ad5f6646974573666249d |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet2.xml | 1274 bytes |
xlm_sheet_03.xml8fc42a49b46107122818a29c3c788c5f4da7f98f832b7cd7336c44079bff7445 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet3.xml | 1277 bytes |
xlm_sheet_04.xml0cc34d68a6dfc34c01213dcb296c84b6bcffbf2a1ff4f58b2391e1bc34549152 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet4.xml | 1274 bytes |
xlm_sheet_05.xmld31f8e28051ceb3adffc3dfc4d67855b80aa09d8e814e84d0fb71fb149ab54a1 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet5.xml | 1274 bytes |
xlm_sheet_06.xmle6c5b77b0a9af449bba825200a075de48e1db4999bcd20622552c6cfac36a13b |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet6.xml | 1274 bytes |
xlm_sheet_07.xml326f37fcf446b146631e154b00af2be442cc6cbb5880bfbe76c0a5fcd0559a4c |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet7.xml | 1152 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.