Office (OOXML) / .XLSX malware analysis — malicious · 41314659fc6539e4

MALICIOUS

Office (OOXML) / .XLSX

658.5 KB Created: 2022-08-10 18:51:50 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2024-08-10

MD5: 51e4c0064961c9c7d11422c8af4624c6 SHA-1: 0765b35965e1e817cab7f1dac05d8a01e0962c75 SHA-256: 41314659fc6539e493e75d1a0117f847edeb027c6274cbb0e829f38275a66746

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file is an Excel document containing an embedded OLE object, specifically identified as an Equation Editor object. Heuristics indicate that this object carries a payload-like Ole10Native stream with an anomalous header and a significantly larger declared size than the actual stream size, suggesting an exploit attempt. The document body contains what appears to be financial or shipping data, likely a lure to disguise the malicious embedded object.

Heuristics 3

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/iw19ctWxb.yF5kd0m contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY

Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `9503f3241dcfaf7aa2f4fd4ab27146981e77023c156dfcc1fa2f24101730c083`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/iw19ctWxb.yF5kd0m	939520 bytes
`ooxml_oleobject_00_ole10native_00.bin` `2c5b043ea7b4d9b47b5de67173c88e4e958c766bc5f06e456a9a9a6dbbf3f03f`	ole-package	OOXML xl/embeddings/iw19ctWxb.yF5kd0m Ole10Native stream: olE10nAtIvE	929721 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.