Office (OOXML) malware analysis — malicious · 033f09f0f8758934

MALICIOUS

Office (OOXML)

32.8 KB Created: 2020-02-01 18:28:07 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2020-09-07

MD5: 87fa50b64797aa86556d1a6f732e7309 SHA-1: 6fb21037268729bf5b8a379321789b2592104147 SHA-256: 033f09f0f875893485319e3adcc75e820a7a58c54f52ac8763e6b0a5abd6dce2

104 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an OOXML file containing an embedded OLE object, specifically identified as an Equation Editor object. This object is known to be exploited to execute arbitrary code. The heuristic firings indicate the presence of shellcode and a suspicious URL, suggesting the file's purpose is to download and execute a second-stage payload. The URL http://b.link/quote_3321A89 was recovered from an embedded OLE object.

Heuristics 5

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject3.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL

An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://b.link/quote_3321A89 In document text (OOXML body / shared strings)

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject3.bin	5936 bytes
SHA-256: `a4f59656683ba59e88c59cd48669fdb10f2ffd049d16777678129a93c52a2cf0`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmd /c ren %tmp%\yy r.js&cscRiPT %tmp%\r.js C
`ooxml_oleobject_01.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject2.bin	10240 bytes
SHA-256: `3d9b6dd9df5b721ef25e244e24d639de43f683d4538f5dacb126ffb9ab91ec1d`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '37487, WScript = sWScript + "."
`ooxml_oleobject_01_ole10native_00.bin`	ole-package	OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	7372 bytes
SHA-256: `684191856d28b0726ac73943903ed182a8104335784f8a8a706018bba887365e`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '37487, WScript = sWScript + "."
`ooxml_oleobject_02.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	3584 bytes
SHA-256: `ff06519a449ffb2a854003ba7089f6ea7298490e54bb06b28c078254b834b32a`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): Wscript.Shell");
`ooxml_oleobject_02_ole10native_00.bin`	ole-package	OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	1018 bytes
SHA-256: `8bf0a73879a06ca9d5494b2c3dec679ce44235a425d2f9c290a1d3a10de933d0`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): Wscript.Shell");
`emf_00.emf`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	4968 bytes
SHA-256: `979dde2aed02f077c16ae53546c6df9eed40e8386d6db6fc36aee9f966d2cb82`
`emf_01.emf`	ooxml-emf	OOXML EMF part: xl/media/image2.emf	1536 bytes
SHA-256: `4d4d1e7b04c99dcb8e885915068ad6f74cc2333e91580cdae5ccaa00c427247f`

Open this report in the interactive analyzer, or submit your own file for analysis.