ZxxZDownloader Office (OOXML) / .XLSX malware analysis — malicious · 471b384ca81a9d80

MALICIOUS

Office (OOXML) / .XLSX

10.1 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2022-05-13

MD5: b90f8e14181f04d2b95575a4ad8fa0b7 SHA-1: dbfc24ba97158d97082be5180bbf20bbbb3d0761 SHA-256: 471b384ca81a9d804992d4e4693ab3d42d419a2e2690ebb146671407fe0809d8

180 Risk Score

Malware Insights

ZxxZDownloader · confidence 95%

MITRE ATT&CK

T1204 Malicious File T1204.002 Malicious File: Exploitation for Defense Evasion

The file is identified as malicious by ClamAV with the signature 'Ole2.Exploit.ZxxZDownloader-9944376-0'. This signature indicates the file likely exploits a vulnerability in the Equation Editor OLE object to download and execute a second-stage payload. The embedded OLE object and the ClamAV detection strongly suggest this attack pattern.

Heuristics 4

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ole2.Exploit.ZxxZDownloader-9944376-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `301e3427aeaaf1afa5a2a3110d72c9fa77e10357f9397ef86a3a5ada7548faba`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	6656 bytes
Detection ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 Obfuscation or payload: unlikely
`emf_00.emf` `60ca1ffcf67457bab82b81f21ee94ca947dc99c8a077df1398db489a7cee22b5`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	6040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.