Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 697ed1a573c956fc…

MALICIOUS

Office (OLE) / .XLS

202.0 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2023-01-24
MD5: b12ce9945c7bd318cf397be4785d3ace SHA-1: bf1cac6f49605e8b374d98227a80ceb5922c1645 SHA-256: 697ed1a573c956fc2491631d4ddb6ea393c1cf0b8283fc5e24785874c017a3a8
148 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.001 Malicious Link: Malicious File T1059 Command and Scripting Interpreter T1059.005 Command and Scripting Interpreter: Visual Basic

The sample contains an embedded Equation Editor OLE object that is known to be exploitable via CVE-2017-11882. The VBA macros, while not containing executable statements directly, are present and could be used to trigger the exploit. This indicates the file is designed to leverage this specific vulnerability to execute a payload.

Heuristics 4

  • Equation Editor Ole10Native payload — CVE-2017-11882 critical CVE likely CVE_2017_11882_EQUATION_OLE10NATIVE
    An embedded Microsoft Equation 3.0 object (CLSID 0002CE02-0000-0000-C000-000000000046) carries an Ole10Native packager stream instead of the normal Equation Native/MTEF data. This is the weaponized Equation Editor RCE delivery shape used by CVE-2017-11882 / CVE-2018-0802 maldocs. The payload (font-record overflow + shellcode) is frequently encrypted and the stream name case-scrambled to evade scanners, but an Equation object holding an Ole10Native stream has no benign use.
  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
  • x86 GetPC stub (CALL $+5; POP ESI) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP ESI)
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
7f506327609c082af1cd37dde23bc2c71a000f7d1ef530b6abb66775040a7673		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1206 bytes
ole10native_00.bin
6465a031c33c0c7e2cfe911f3495288a19415da64abff2197f00024c6eb43ce7		 ole-package OLE Ole10Native stream: MBD0133C852/olE10NaTIvE 1413 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.