Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 1dc30d9d91bde755…

MALICIOUS

Office (OOXML)

741.9 KB Created: 2019-11-27 09:20:57 UTC Authoring application: Microsoft Excel 12.0000
MD5: a8551ea61cf59fdd81685288040d9353 SHA-1: c62cfefbede937d5f04110760bf8588e04500c88 SHA-256: 1dc30d9d91bde7559051cf046537d0aad4bf1a3dce6db1a8cf7cb95b15cbd86d
100 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an OOXML document containing an embedded OLE object, specifically identified as an Equation Editor object. Heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous header, suggesting it's designed to exploit a vulnerability for client execution. The document body contains what appears to be a parts list in Afrikaans, which is likely a lure to disguise the malicious embedded object.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/YuCs.YtBO contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
53e34e0ce6b962719c022ed8c8678f5147096633e16c2e0f7a1266356aecf354		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/YuCs.YtBO 1030144 bytes
ooxml_oleobject_00_ole10native_00.bin
21c6f3dc2c0af1e47850c237e62197f3d1f00c8c9000270bd958cbc17ae68eec		 ole-package OOXML xl/embeddings/YuCs.YtBO Ole10Native stream: OlE10nativE 1019432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.