Office (OOXML) / .XLSX malware analysis — malicious · 29c8fd226c3a55ca

MALICIOUS

Office (OOXML) / .XLSX

711.5 KB Created: 2020-05-18 06:42:12 UTC Authoring application: Microsoft Excel 15.0300

MD5: 12027927d28467fc65194237bbab3774 SHA-1: a5ac7a601b67b6ba19133ba7804ee82481e11ca0 SHA-256: 29c8fd226c3a55ca5d8013e8bb31c87313ab7f316f8b43b5742a59e7bde2d473

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The sample is an Office document containing an embedded OLE object, specifically identified as an Equation Editor object. Heuristic analysis indicates a critical vulnerability, CVE-2017-11882, which is triggered by a FONT record overflow within the Equation Editor. This exploit allows for arbitrary code execution. No scripts were extracted, but the presence of the vulnerable OLE object strongly suggests an attempt to leverage this known vulnerability for malicious purposes.

Heuristics 3

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/YyxyvG7.fi1WhKK contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `8002f04d65efb18e97a7618d0755f3b6912290fcee8784b7851e80cbb37ef57c`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/YyxyvG7.fi1WhKK	942592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.