Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 639201b3ff431e46…

MALICIOUS

Office (OOXML) / .XLSX

2.00 MB Created: 2025-04-16 03:58:07 UTC Authoring application: Microsoft Excel 12.0000
MD5: bc07c302048f467924c9c7f765e2e2d7 SHA-1: 7244443b3b383743fe14e22261067f0e0abb96ec SHA-256: 639201b3ff431e46c187340d4ab40071274227851f5136be4fbfb416b1560d9d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is an Excel spreadsheet containing an embedded OLE object, specifically an Equation Editor object, which is known to be exploited to deliver malicious payloads. The document body contains a lure instructing the user to enable editing, a common tactic to bypass macro security. The OLE object exhibits anomalies in its Ole10Native stream size, indicating it likely contains a second-stage payload.

Heuristics 4

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/3W6.aUfslUH contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
f5ed64e69b8d17399e790b2c3d589e98e151c6eadf4e5878bb67324120dd79a4		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/3W6.aUfslUH 2888192 bytes
ooxml_oleobject_00_ole10native_00.bin
45a5d45fe5a4aaaad1e525f150292f15558f3d9e3ebc701fb864a4e29f0a30c7		 ole-package OOXML xl/embeddings/3W6.aUfslUH Ole10Native stream: Ole10NaTive 2862672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.