Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 085555bf9e9abd74…

MALICIOUS

Office (OOXML) / .XLSX

712.4 KB Created: 2010-06-04 08:55:28 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2023-08-08
MD5: 15001e69702b5cbbe9d3fc6e43b12097 SHA-1: 8e493f2fd24285832fae22491cd07a8c3853f015 SHA-256: 085555bf9e9abd741fd446a3112a4798dc576de3bede8ef872e87e14c270ef34
100 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The file is an Excel document containing an embedded OLE object, specifically identified as an Equation Editor object. Heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous header, suggesting it's being used to exploit a vulnerability. The presence of this anomalous object strongly points towards an exploit delivery mechanism, likely leveraging the Equation Editor vulnerability to execute a secondary payload.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/XTTUzmk.Io8 contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
fd3a8c586265d1f04adf8df1621076b1156793e2d4518330a68ed37e692375c7		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/XTTUzmk.Io8 1046528 bytes
ooxml_oleobject_00_ole10native_00.bin
95cd0b871ab756a952797f36c65e8108413d9338b22829591ace6c593d69093b		 ole-package OOXML xl/embeddings/XTTUzmk.Io8 Ole10Native stream: olE10natIVe 1035947 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.