Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 db848dda127a0742…

MALICIOUS

Office (OOXML) / .XLSM

100.1 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300
MD5: 92596f6c6acac93cbfd9ad419b6ba0bf SHA-1: 6d42d7a5890d2cf39925fdeac4bfd4305d52ddea SHA-256: db848dda127a0742f59f461ca9654cf73c356aae0b01801e6854d0c8add02f82
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1027 Obfuscated Files or Information T1059.001 PowerShell

This XLSM file contains a Workbook_Open macro and Excel 4.0 macros designed to download and execute additional payloads. The VBA code constructs commands to run 'regsver32' with various filenames like '..\Popol.gors' and '..\Popol.ocx3', suggesting a downloader or dropper functionality. The Excel 4.0 macros also appear to be involved in constructing URLs and potentially downloading files. The ClamAV detection 'Xls.Downloader.Docusign112101-9908076-0' further supports the downloader classification.

Heuristics 6

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • ClamAV: Xls.Downloader.Docusign112101-9908076-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Docusign112101-9908076-0
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://190.14.37.89/
    • http://74.119.195.114/
    • http://212.6.44.229/
    • http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revision
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
3c3e714d9cd7fb9b9e788b237ef8495032fc0fb331e3cfb5d84c959aa88aa850		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2651 bytes
vbaProject_00.bin
438634a363cc6eaaf56e5e24b297454fb9cac2470c59c18edb28823c90a95331		 vba-project OOXML VBA project: xl/vbaProject.bin 12288 bytes
xlm_sheet_00.xml
e47a1bb05005baa6c77d44783526fc711a37f6dacba438304270e1475494804a		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 3426 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.