Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 07b4dcac8d6c027e…

MALICIOUS

Office (OOXML) / .XLSX

27.7 KB Created: 2021-08-19 14:03:52 UTC Authoring application: Microsoft Excel 15.0300
MD5: 657851accd5a698db87403655701c0e9 SHA-1: 40823997d0d0c752cdca64f24282239f0b1200af SHA-256: 07b4dcac8d6c027ec6c56fdd9f9f5aec38416bae2d54c4dfe8bab839d3570cd4
100 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a malicious Excel file containing an embedded OLE object that exploits CVE-2018-0798 in the Equation Editor. This vulnerability allows for arbitrary code execution when the embedded object is activated. No specific family could be identified, but the exploit mechanism is clear.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • CVE-2018-0798 — anomalous Equation Editor native stream high CVE likely CVE_2018_0798_EQUATION_NATIVE_ANOMALY
    Embedded Equation Editor OLE data contains anomalous native stream bytes consistent with a CVE-2018-0798-style Equation Editor exploit. This is treated as likely CVE evidence because the Equation object is malformed and payload-like, but it does not match the exact public matrix-overflow byte signature.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
3de3717b1bebff7ddef0b7b6ca0034a3025bbb1e2fc0bd8f455097a5f036882b		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 4096 bytes
ooxml_oleobject_00_ole10native_00.bin
215b08095327ef7b57e13b0fad4252bc03131a5cca300591cc50b332f3fbdeb4		 ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: oLe10nATiVE 1688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.