Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 6cd9d6d2a12e7685…

MALICIOUS

Office (OLE) / .XLSX

43.0 KB First seen: 2022-08-02
MD5: 26c136865b24c10bc56f2c094b5c61e7 SHA-1: b79e25bcd3623334b759712915b21fd6600cebb6 SHA-256: 6cd9d6d2a12e7685a7be49ae9d74711e5ce9e0e0442b775bea4a8ab6b6daa758
142 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell T1204 User Execution

The sample is a password-encrypted Office document that exploits CVE-2017-0199 via an OLE2Link object. This technique is used to download and execute a secondary malicious document from the provided URL. The document body could not be extracted due to encryption, but the exploit carrier shape and embedded URL are strong indicators of malicious intent.

Heuristics 5

  • OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199
    Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
  • Default-encrypted OOXML exploit carrier layout high OOXML_ENCRYPTED_EXPLOIT_CARRIER_SHAPE
    Default-password encrypted OOXML package contains embedded OLE object parts and additional activation/decoy parts. This layout is common in malicious Excel exploit delivery and requires inspecting the decrypted package.
  • Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGE
    OLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).
  • Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXML
    OLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wwwarglobalincinte.sytes.net/swiss/trn18/trn18.docx?&cracker=equable&germany=ceaseless&wet-bar=colossal&oyster

Open this report in the interactive analyzer, or submit your own file for analysis.