Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 6a09d76a9977b594…

MALICIOUS

Office (OOXML) / .XLSX

222.3 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000
MD5: 840c22c95fcc825501c9a71bd610ba31 SHA-1: 3c8063aea1a1fd35d1c55d2a34b4b57f93736e26 SHA-256: 6a09d76a9977b594f9bf8aaaa6b05dba8031a3d4bd4f1194badd488719813fb2
108 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is an Excel file containing an embedded OLE object, specifically identified as a Microsoft Equation Editor object. High-severity heuristics indicate an anomaly consistent with CVE-2018-0798, which is an exploit targeting Equation Editor to achieve arbitrary code execution. No VBA macros or scripts were extracted, but the presence of the vulnerable OLE object is sufficient evidence of exploitation.

Heuristics 4

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • CVE-2018-0798 — anomalous Equation Editor native stream high CVE likely CVE_2018_0798_EQUATION_NATIVE_ANOMALY
    Embedded Equation Editor OLE data contains anomalous native stream bytes consistent with a CVE-2018-0798-style Equation Editor exploit. This is treated as likely CVE evidence because the Equation object is malformed and payload-like, but it does not match the exact public matrix-overflow byte signature.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
19012fe2741f7ef4bbc9c0fa8fa32c0958a08910b8566855d8723be42efa6ee9		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 4096 bytes
ooxml_oleobject_00_ole10native_00.bin
b0eb07aeb495073b987d902e3d271e2621fe3a03d71176a84d9ffa090a8cd477		 ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: olE10natiVE 1690 bytes
ooxml_oleobject_01.bin
4a30a485bc54b6a2362f90333fef8c83aa218e9057c256f35a54284a81844f6d		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/Microsoft_Office_Word_Macro-Enabled_Document1.docm 28352 bytes
emf_00.emf
9d27e95da65e04bf68ea892a8fb27e92240e7e5e60dacfd9714a11521ae3e2d4		 ooxml-emf OOXML EMF part: xl/media/image8.emf 498420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.