Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 b234169c31608a2f…

MALICIOUS

Office (OOXML) / .XLSX

109.4 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300
MD5: 15d3f15fdb71e88b3c05a52395a1c30d SHA-1: 4289031dbde330c54cc3353a4c95cdf642f2089e SHA-256: b234169c31608a2fb3085e061093b3983a5293a34da8060c43df5fa38a7c94fd
188 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel file containing Excel 4.0 macros, which are known to be used for malicious purposes. The critical heuristics indicate the use of dangerous XLM formula APIs like CALL and EXEC, which are typically used to download and execute payloads. The presence of multiple unknown URLs suggests these are the sources for the secondary payload. The Auto_Open macro further confirms the intent to execute malicious code upon opening the document.

Heuristics 6

  • Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Dangerous XLM formula APIs: HALT, GOTO, REGISTER, EXEC critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 3 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://91.211.91.82/44313,6048108796.dat
    • http://82.117.252.199/44313,6048108796.dat
    • http://45.138.157.43/44313,6048108796.dat
    • http://91.211.91.82/
    • http://82.117.252.199/
    • http://45.138.157.43/
    • http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
19626508773a68d544063e9cd47e5407816d3506d0c5df431dfadcc2ae560644		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 786 bytes
vbaProject_00.bin
199889e0394000a2e1581ef295e9f53a3c6d626d9f7063b3c9ef8cf8e3ca63c5		 vba-project OOXML VBA project: xl/vbaProject.bin 10240 bytes
xlm_sheet_00.xml
a3ff78ad476320d5df05f36d29827f0ccf7c95830338250c5be8e68dc7098191		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 4285 bytes
xlm_sheet_01.xml
a5fc80b1569128bd0323daacf4b0484b147d9d37755aacc26435ea011bd9f0cd		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 2111 bytes
xlm_sheet_02.xml
a6c079d2a564b952bdc7f60d49402489a374e91f07f8b51ef328523d2a650900		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.xml 1944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.