Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 62bdafadb015ac07…

MALICIOUS

Office (OOXML) / .XLSX

766.4 KB Created: 2012-07-25 03:59:57 UTC Authoring application: Microsoft Excel 16.0300
MD5: ff11f18f4ce8621fbc3efa537a826bba SHA-1: 9b5a20d17108a0ab21deab61de3d5cf08cdff76a SHA-256: 62bdafadb015ac07e3225b149895b341e79a4d79e8d1737472c18b97560f2d3f
110 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an Excel document containing an embedded Equation Editor OLE object, which is a known vector for exploiting vulnerabilities. The OLE object's Ole10Native stream exhibits anomalies suggesting it carries a payload. The document also contains an external hyperlink to 'http://www.astermedispro.com/', which may be related to the payload delivery or command and control.

Heuristics 5

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/eDwF.cP0CwC contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • External hyperlinks (2) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 2 external hyperlinks — clickable URLs are stored as external relationships. First target: http://www.astermedispro.com/
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.astermedispro.com/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
b3c101519df952d46735983464f169614d3a49126d06fd678079c9ae73f86209		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/eDwF.cP0CwC 1014784 bytes
ooxml_oleobject_00_ole10native_00.bin
adb116afbb8178feca544dcd2023b06a1252f1ea0787b8747eabd69632be04a9		 ole-package OOXML xl/embeddings/eDwF.cP0CwC Ole10Native stream: OLE10natIVe 1004463 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.