Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 2ef4e22d4ed5d753…

MALICIOUS

Office (OOXML) / .XLSX

680.6 KB Created: 2023-07-26 19:45:53 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2023-09-15
MD5: d861c4958a53da4b32baa07ba257ac68 SHA-1: 0ed4505747415d984f339d0c7e4de1877825dd94 SHA-256: 2ef4e22d4ed5d75349cb41cb0333260efb5292703b25ae79fa12ed88a318b405
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is identified as malicious due to the presence of an embedded OLE object, specifically an Equation Editor object. This object contains an anomalous Ole10Native stream, indicating it likely carries a secondary payload. The high entropy of this stream further suggests it is packed or encrypted executable content.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/dx.jWm contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
ba075a230ec8b59b3cf75d81d116033ed7fc8dd1f8c7abf0bc8c00d877e4ad9b		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/dx.jWm 948736 bytes
ooxml_oleobject_00_ole10native_00.bin
4cd5c24b5a72267ba48811887e583dd53a3ca65543f3ee4187f93f1ea27a90e2		 ole-package OOXML xl/embeddings/dx.jWm Ole10Native stream: OlE10natiVE 938662 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.