Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 39f3c234507061d2…

MALICIOUS

Office (OOXML) / .XLSX

1.21 MB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000
MD5: 58d1d92cfaadfc7969d71bc56270555b SHA-1: f68e5fa35a2b556ff389a3cb27aa78fce485c82e SHA-256: 39f3c234507061d2b99efe08be1b29aeb3d0a0e699c733f5460172e3681b45a8
110 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The sample is an Office Open XML (OOXML) file containing an embedded OLE object, specifically identified as a Microsoft Equation Editor object. High-severity heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous header and a significantly larger declared inner size than the actual stream size. This strongly suggests the exploitation of a vulnerability within the Equation Editor component to execute arbitrary code. The presence of hidden worksheets further supports the concealment of malicious content. No scripts were extracted, and the URLs found are confirmed benign or unknown, thus the primary attack vector appears to be the embedded OLE object exploiting a known vulnerability.

Heuristics 5

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.day.com/dam/1.0
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/tiff/1.0/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
1fdb13b01c5a3a01b1831e069c11ce976f81702696cd378ac431dc331474fa86		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 10240 bytes
ooxml_oleobject_00_ole10native_00.bin
59fb77315591a55324873430963abffa12244adc4996302250a87d8a758a5796		 ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 8667 bytes
ooxml_oleobject_01.bin
614418f1f2fed732b5f56ff703dd7809bb8f9b89d40552f6af11191b0e143097		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 912384 bytes
ooxml_oleobject_01_ole10native_00.bin
7ff01675d16eea760e999141da5d08d963751a35d78fbd3b5ddaa1d6aebba5f5		 ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: olE10NAtivE 902857 bytes
emf_00.emf
f4609092cee9304668c8583221a0b9c12e6ae3c9c67f0b4e6d5fbde8201ac054		 ooxml-emf OOXML EMF part: xl/media/image6.emf 1183280 bytes
emf_01.emf
798db6df40123a9ad9b1f278ac833caa4930e80336ddce73f59f7f97538b03c4		 ooxml-emf OOXML EMF part: xl/media/image7.emf 7608 bytes
emf_02.emf
1ab8f5abd845ffd0c61a61bb09bfcf20569b80b4496bccb58c623753cf40485c		 ooxml-emf OOXML EMF part: xl/media/image8.emf 4056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.