Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 e2ec81c62d7aad9e…

MALICIOUS

Office (OOXML) / .XLSM

29.0 KB Created: 2020-11-24 09:53:01 UTC Authoring application: Microsoft Excel 16.0300
MD5: 4c63dbcdb03dac0c78bb21d1de12ec60 SHA-1: fa062e352f3bcee0b1412ab1cde68c4f4f8dee28 SHA-256: e2ec81c62d7aad9ee7f0d421f0afd0f7415711d2f41e39bc1d194e87cfff84ef
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059.005 Visual Basic

This XLSM file contains VBA macros that leverage Excel 4.0 macro sheet functionality. The VBA code in 'macros.bas' appears to construct and execute a command by concatenating strings and using the `Run` function on a dynamically named sheet. The `PagamentoDocumento` subroutine is called, which then sets a cell value and runs a macro named 'Auto_io22'. The `excell` subroutine schedules `BarUno` to run, which closes the workbook. The overall intent is to execute arbitrary code via the macro sheet, likely to download and run a second-stage payload.

Heuristics 5

  • VBA ActiveX event runs worksheet-decoded XLM formulas critical OLE_VBA_ACTIVEX_XLM_CELL_STAGER
    VBA code attached to an ActiveX/UserForm event reconstructs formula text from worksheet constants using Split/Replace/Mid or character shifting, then executes it through ExecuteExcel4Macro or Run. This is a high-confidence malware stager that hides XLM formula execution in sheet cells; it is not a document-parser CVE.
  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
    • http://schemas.microsoft.com/office/excel/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
8e10ea5536973c4a702b510d41cb58c99ef0bd40763c2a630b9956d5991c0c3d		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1370 bytes
vbaProject_00.bin
50472c30ed5ef1067055459c36629e3bdb9152af234f47aefd0949b97341533e		 vba-project OOXML VBA project: xl/vbaProject.bin 13824 bytes
emf_00.emf
76f287b1e3251b7e0e5ba27bfb05b35831150cc665de00f9fd2d807e2d2a028d		 ooxml-emf OOXML EMF part: xl/media/image1.emf 1976 bytes
xlm_sheet_00.xml
7b123f25444cc6671f38ba962c4145783eefcdaabc27d46dafaacfb645e74c5f		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 865 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.