Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 24ee3950b66b09a4…

MALICIOUS

Office (OOXML) / .XLSX

783.5 KB Created: 2020-08-20 17:59:18 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2023-03-21
MD5: e19c8e77a1e7ae5a51ae4fe7648abaaf SHA-1: de2da5c4b2aec11b8077a63ad8d676fed55b0515 SHA-256: 24ee3950b66b09a44ec65d98d3837b5caecec3faf7a7298648aaf32aa1734f64
108 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is an Excel document containing an embedded OLE object, specifically identified as an Equation Editor object. Heuristics indicate this object carries a payload-like Ole10Native stream with an anomalous size, suggesting it's designed to deliver a secondary exploit or payload. The document body contains invoice-like text, reinforcing the lure aspect.

Heuristics 4

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/dPbMI.LXra1 contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
bf395f5040bd9485e24e966f59ecdf79206ca2238a6342f7d62f3fc03a72ba77		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/dPbMI.LXra1 954880 bytes
ooxml_oleobject_00_ole10native_00.bin
5e5b7c6544de32db5b7b3557c7c273d8d5faa64da19b2212189dc7b3f99a8366		 ole-package OOXML xl/embeddings/dPbMI.LXra1 Ole10Native stream: OlE10natiVE 944971 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.