Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 68f484a921e09355…

MALICIOUS

Office (OOXML) / .XLSX

2.56 MB Created: 2025-09-04 00:14:20 UTC Authoring application: Microsoft Excel 12.0000
MD5: 43d3f2f7b9acfe33b0067b491c870c3b SHA-1: fb014a94da953a49f8baea4b2b4e690dac25d859 SHA-256: 68f484a921e09355422e4ddbfc3f7f7c29d120969adbcfd61cc2058a76bd6505
140 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an Office document containing an embedded OLE object, specifically identified as an Equation Editor object vulnerable to CVE-2017-11882. This exploit is commonly used to achieve arbitrary code execution. The presence of a "content-enable lure" heuristic further suggests the document is designed to trick users into enabling content, facilitating the exploit. No specific family could be identified, but the exploit vector is clear.

Heuristics 4

  • CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
    Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/3rsPHkj.7p1 contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
79507e166937930857c9c75b731f0eae1a8f468b19a516bc7763072948b032d8		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/3rsPHkj.7p1 3054080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.