Office (OOXML) malware analysis — malicious · 0b54f50173d8f8cb

MALICIOUS

Office (OOXML)

12.1 KB Created: 2013-05-27 19:35:28 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2015-09-30

MD5: ac37e3ea2faa2f98fe4eac08b7216070 SHA-1: 6bbf1def347b71b97f0968b6cd9a848a3c6cba4e SHA-256: 0b54f50173d8f8cbc50cc5bdb40a5b63cca49868814c5deead99a6a7979379c4

200 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an OOXML document containing an embedded OLE object. This object is identified as an 'Ole10Native package' that drops an auto-executable payload, specifically the EICAR test file. The presence of the EICAR test file and the mechanism of dropping an executable strongly indicate a malicious intent to deliver a payload.

Heuristics 3

ClamAV: Eicar-Test-Signature critical CLAMAV_DETECTION

ClamAV detected this file as malware: Eicar-Test-Signature
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	2560 bytes
SHA-256: `ee5e79f59be600cce75cc6f38e7a32c39bb4f50f1aa3f891846341de10e7d269`
Detection ClamAV: Eicar-Test-Signature Obfuscation or payload: unlikely
`ooxml_oleobject_00_ole10native_00.bin`	ole-package	OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native	166 bytes
SHA-256: `f492d5103eb8ecee95b6b54f09ab1f25239406b494b3ae307a0d0c756b4e4cb2`
`emf_00.emf`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	8456 bytes
SHA-256: `5345bed6dc88ae7192aec09ed550cd3290ab0a61cc746fec0628f6117d8d0e7c`

Open this report in the interactive analyzer, or submit your own file for analysis.