Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 2afa19a5551be28b…

MALICIOUS

Office (OOXML) / .XLSX

1.29 MB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000
MD5: 47187ea67a417c5f449dfd1b0b47100c SHA-1: 7db3d3eb0ea082135ca90bd10ec462d8d51205b2 SHA-256: 2afa19a5551be28b993617faabc28d8c663703945c268b4a4d6d93383a5e3d5c
110 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 Command and Scripting Interpreter T1071.001 Application Layer Compromise T1566.001 Phishing T1071.002 Remote Services - SMB/Windows

The file's verdict and heuristic firings strongly indicate malicious intent. The presence of a malformed Ole10Native stream within an OLE object containing the Equation Editor CLSID is a key indicator of an attempt to exploit CVE-2017-11882. The hidden sheet and embedded URLs further support this assessment, suggesting a staged delivery mechanism. The file likely attempts to execute code via the Equation Editor component, potentially leading to remote code execution.

Heuristics 5

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL http://www.day.com/dam/1.0
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/tiff/1.0/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
1ceff71aec1eae14805a071ce6bc964ef7d3dd55e9d1a295e6770aec01c37f67		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 5120 bytes
ooxml_oleobject_01.bin
06e82a8e5ed96289991a83df5a14de8fca23ac4da9b0f1367e80ef76a4cf23e4		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject4.bin 10240 bytes
ooxml_oleobject_01_ole10native_00.bin
59fb77315591a55324873430963abffa12244adc4996302250a87d8a758a5796		 ole-package OOXML xl/embeddings/oleObject4.bin Ole10Native stream: Ole10Native 8667 bytes
ooxml_oleobject_02.bin
7741c755e6e5ab547d0d0b819ea9fc34e713992b849df79b8ca2053561c0d16b		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 903168 bytes
ooxml_oleobject_02_ole10native_00.bin
61f9f822e80df1930f12ec29265e6a8562426c0900887de0f258b23446c1eb57		 ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: OLE10naTive 893917 bytes
ooxml_oleobject_03.bin
3b687afec837f365f6ad8ddea22add0e740b8a05f9c3c70bce2bd56b67533ecd		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 3700224 bytes
ooxml_oleobject_03_ole10native_00.bin
079553d7ab4785a82155c9ad8a77bb8aac84989e54fd6ba4892bc43e2c43717b		 ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 3668580 bytes
emf_00.emf
288ed419a9f274886b09710cca32cfdb99941fb4fb002944e43f91c0d836d668		 ooxml-emf OOXML EMF part: xl/media/image5.emf 7608 bytes
emf_01.emf
242bab08be1b4dfdf7508de3970c0cdba94ae6c9899ce66aecc38c5823e45165		 ooxml-emf OOXML EMF part: xl/media/image4.emf 5512 bytes
emf_02.emf
348c6658e3bb6508318424c2402f6b99f390bbc67a31305476fea12da0ff67a2		 ooxml-emf OOXML EMF part: xl/media/image3.emf 648132 bytes
emf_03.emf
e47ca5b97dc4da34b3125e61d2ec840ef506be97561be73926c2dc459722b9e5		 ooxml-emf OOXML EMF part: xl/media/image2.emf 7337552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.