Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 4ed6dfa6952db6e2…

MALICIOUS

Office (OLE) / .XLSX

32.5 KB
MD5: 78e26a51fc8c419c139fcba9a46d85f5 SHA-1: f0ab41a8bd708c672162496d807595b1748811a9 SHA-256: 4ed6dfa6952db6e29f32ac4c69ee7cd4eaf683ad7f2273656b79075cdd03d0da
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The OOXML file is encrypted with a default password, a common technique for obfuscating malicious content. Heuristics indicate it's an exploit carrier containing an OLE object, suggesting it's designed to drop or execute a secondary payload. No document body or script content was available for further analysis.

Heuristics 2

  • Default-encrypted OOXML exploit carrier layout high OOXML_ENCRYPTED_EXPLOIT_CARRIER_SHAPE
    Default-password encrypted OOXML package contains embedded OLE object parts and additional activation/decoy parts. This layout is common in malicious Excel exploit delivery and requires inspecting the decrypted package.
  • Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXML
    OLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.

Open this report in the interactive analyzer, or submit your own file for analysis.