Formbook — Office (OLE) / .XLSX malware analysis

Static analysis result for SHA-256 3eea1a048dee9676…

MALICIOUS

Office (OLE) / .XLSX

176.8 KB First seen: 2022-07-08
MD5: b6580aab096c74e38bb23d25cd637d2f SHA-1: eea28d284f31a8d73e1718e78d871287e0a629c5 SHA-256: 3eea1a048dee967677325a8709d868824dc78d868e4fae28617e1402d1e7fad2
240 Risk Score

Malware Insights

Formbook · confidence 85%

MITRE ATT&CK
T1204.002 User Execution: Malicious File T1059.001 Command and Scripting Interpreter: PowerShell T1204.001 User Execution: Malicious Link T1204.002 User Execution: Malicious File

The sample is a password-encrypted Office document using the default VelvetSweatshop password, a common technique to evade detection. It contains an OLE Equation Editor object (xl/embeddings/oleObject1.bin) which is a known carrier for exploits like CVE-2017-11882. The ClamAV detection specifically identifies this as a Formbook downloader, attributing the same pattern of encryption and exploit delivery to this family.

Heuristics 6

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Default-encrypted OOXML embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Encrypted Office package with CFB FAT corruption critical OLE_ENCRYPTED_AND_MALFORMED
    Encrypted-package shape co-occurs with FAT-chain corruption — the documented combined evasion form.
  • ClamAV: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0
  • Default-encrypted OOXML exploit carrier layout high OOXML_ENCRYPTED_EXPLOIT_CARRIER_SHAPE
    Default-password encrypted OOXML package contains embedded OLE object parts and additional activation/decoy parts. This layout is common in malicious Excel exploit delivery and requires inspecting the decrypted package.
  • Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGE
    OLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).
  • Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXML
    OLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.

Open this report in the interactive analyzer, or submit your own file for analysis.