MD5 007de2c71861a3e1e6d70f7fe8f4ce9b is a malicious document: a spreadsheet with Excel 4.0 macros.
Excel 4.0 macros predate VBA macros: they are composed of functions placed inside cells of a macro sheet.
These macros are not stored in dedicated VBA streams, but as BIFF records in the Workbook stream.
Spreadsheets with Excel 4.0 macros can be analyzed with oledump.py and plugin plugin_biff.py.
Option -x of plugin_biff will select all BIFF records relevant for the analysis of Excel 4.0 macros:
In this output, we have all the BIFF records necessary to 1) determine that this is a malicious document and 2) report what this maldoc does.
The first BIFF record, BOUNDSHEET, tells us that the spreadsheet contains a Excel 4.0 macro sheet that is hidden.
The third BIFF LABEL record tells us that there is a cell with name Auto_Open: the macros will execute when the spreadsheet is opened.
And then we have BIFF FORMULA records that tell us that something is CONCATENATEd and EXECuted.
The BIFF STRING record provides us with the exact command (msiexec …) that will be executed.
The latest version of plugin_biff contains much larger lists of tokens and functions used in formula expressions. Of course, it’s still possible that tokens and/or functions are used unknown by my plugin. This is now clearly indicated in the output:
*UNKNOWN FUNCTION* is reported when a function number is unknown. The function number is always reported. Here, for the sake of this example, a crippled version of plugin_biff reports functions with number 0x0037 and 0x0150. In the released version of plugin_biff, functions 0x0037 and 0x0150 are identified as RETURN and CONCATENATE respectively.
*INCOMPLETE FORMULA PARSING* is reported when a formula expression can not be fully parsed. Left of the warning *INCOMPLETE FORMULA PARSING*, the partially parsed expression can be found, and right of the warning, the remaining, unparsed expression is reported as a Python string. If the remainder contains bytes that could be potentially dangerous functions like EXEC, then this is reported too.
The complete analysis of the maldoc is explained in this video:
Didier Stevens 
[…] Blog post: Maldoc: Excel 4.0 Macro […]
Pingback by Didier Stevens Videos — Friday 15 March 2019 @ 0:04
[…] Maldoc: Excel 4.0 Macro […]
Pingback by Overview of Content Published in March | Didier Stevens — Monday 1 April 2019 @ 0:01
Hello, I have an Excel 4.0 Macro malicious file with a lot of obfuscation and functions. Would you walk me through decoding with oledump^
Comment by Francis — Wednesday 27 May 2020 @ 13:39
If it’s on VT you can post the hash here.
Comment by Didier Stevens — Wednesday 27 May 2020 @ 22:05
Hi Didier,
Here is the sample I was talking about.
1f56f03c804db395854a2de9bc7dd9dad4fccd744df927a8d723f70a021c6952
https://www.virustotal.com/gui/file/1f56f03c804db395854a2de9bc7dd9dad4fccd744df927a8d723f70a021c6952/detection
Comment by Francis — Thursday 28 May 2020 @ 11:43