Office (OOXML) / .XLSM malware analysis — malicious · d905e18284f96852

MALICIOUS

Office (OOXML) / .XLSM

114.2 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: 4bb9a0b3083ea187a4720719202acd0b SHA-1: 68e57e29e7608e7bbaa4e32c0c896ccb208dc351 SHA-256: d905e18284f96852f43a3e0c5ce0ec8d732a5edb571e59fffba9ec2a47f73dcc

188 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an XLSM file containing Excel 4.0 macros, which are known to be used for malicious purposes. The critical heuristics indicate the use of dangerous XLM formula APIs like FORMULA, HALT, GOTO, REGISTER, and EXEC, which can be used to download and execute payloads. The presence of an Auto_Open macro further suggests automatic execution upon opening. The embedded URLs are highly suspicious and likely serve as the source for the second-stage payload. No VBA macros were explicitly extracted, but the XLM macros are sufficient to infer the download and execution behavior.

Heuristics 6

Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Dangerous XLM formula APIs: FORMULA, HALT, GOTO, REGISTER, EXEC critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 3 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://91.211.91.81/44313,6048108796.dat
- http://5.34.179.36/44313,6048108796.dat
- http://45.153.229.23/44313,6048108796.dat
- http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `aa10abebc3ece39bf198cf3383ccb30417606e0a98d60e87747026c15426213c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2437 bytes
`vbaProject_00.bin` `c273c0ba9b123bfd6c5297a7692bdade93c1afc5139260c65963114883a46fd3`	vba-project	OOXML VBA project: xl/vbaProject.bin	23552 bytes
`xlm_sheet_00.xml` `665f6c9f9b4a972fb7c9cd862f5d81f8391866e0188d24c7f028f17a82f6de37`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	4505 bytes
`xlm_sheet_01.xml` `c842664d4adfbab64cc38d3d12f48bc3fe942196965e9c614671ea94f3e6afd5`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.xml	2129 bytes
`xlm_sheet_02.xml` `10c797d7a3c632796484bdf562cdd2d33c46d8d630def0609945fce50d2eff68`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet3.xml	1949 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.