90 lines
3.0 KiB
Markdown
90 lines
3.0 KiB
Markdown
---
|
|
name: analyzing-excel-4-macro-malware
|
|
description: 'Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet
|
|
formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download
|
|
or execution primitives (EXEC, CALL, REGISTER). Activates for requests to analyze XLM macros,
|
|
examine Excel 4.0 macro sheets, or deobfuscate legacy spreadsheet macros.'
|
|
domain: cybersecurity
|
|
subdomain: malware-analysis
|
|
tags:
|
|
- malware-analysis
|
|
- xlm
|
|
- excel4
|
|
- macros
|
|
- document-malware
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1059.005
|
|
- T1204.002
|
|
- T1027
|
|
d3fend:
|
|
- D3-FCR
|
|
- D3-DA
|
|
references:
|
|
- 'MITRE ATT&CK T1059.005 Visual Basic / macros — https://attack.mitre.org/techniques/T1059/005/'
|
|
- 'Microsoft Excel 4.0 macro functions reference — https://learn.microsoft.com/office/'
|
|
---
|
|
|
|
# Analyzing Excel 4.0 Macro Malware
|
|
|
|
## When to Use
|
|
|
|
- You have an extracted Excel 4.0 (XLM) macro sheet (e.g., from a `.xls`/`.xlsm` dumped with
|
|
oletools/XLMMacroDeobfuscator) and need to find auto-run cells and execution primitives.
|
|
- You are triaging maldocs that hide logic in legacy macro sheets rather than VBA.
|
|
|
|
**Do not use** Excel to open the document to "see" the macro — opening triggers the auto-run
|
|
cells. Work from the extracted formula text statically.
|
|
|
|
## Prerequisites
|
|
|
|
- The extracted XLM formula text (cell address → formula). Optional: `oletools` to extract it.
|
|
|
|
## Safety & Handling
|
|
|
|
- Never open the workbook in Excel; analyze the extracted formulas inertly. Defang URLs.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Find auto-executing entry points
|
|
|
|
```bash
|
|
python scripts/analyst.py analyze macros.txt
|
|
```
|
|
|
|
Flags defined-name triggers (`Auto_Open`, `Auto_Close`) and the cells they point to, plus
|
|
`=HALT()`/`=RETURN()` flow markers.
|
|
|
|
### Step 2: Identify execution and download primitives
|
|
|
|
Detects `EXEC(`, `CALL(`, `REGISTER(` (Win32 imports), and URLDownload-style `CALL` patterns that
|
|
fetch and run a payload.
|
|
|
|
### Step 3: Unwind obfuscation
|
|
|
|
Surfaces `CHAR()`/`&` string-building, `FORMULA.FILL`/`FORMULA` self-writing, and base/`MID`
|
|
slicing used to hide strings; reconstructs concatenated literals where possible.
|
|
|
|
### Step 4: Extract IOCs
|
|
|
|
Pull URLs/paths and defang them; record the execution method (regsvr32, rundll32, mshta).
|
|
|
|
## Validation
|
|
|
|
- Auto-run entry cells are identified, not just the presence of macros.
|
|
- Execution primitives (EXEC/CALL/REGISTER) are reported with their arguments.
|
|
- Reconstructed strings and URLs are defanged.
|
|
|
|
## Pitfalls
|
|
|
|
- Heavily obfuscated sheets that self-write cells at runtime — static reconstruction is partial.
|
|
- Macro sheets hidden as `Very Hidden` that simple viewers miss.
|
|
- Confusing benign legacy spreadsheets that legitimately use XLM.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
|
|
- ATT&CK T1059.005 and the Excel 4.0 macro reference (linked in frontmatter).
|