Office (OOXML) / .XLSX malware analysis — malicious · 6f721e74a6939cb9

MALICIOUS

Office (OOXML) / .XLSX

667.0 KB Created: 2023-09-14 22:49:28 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2023-09-15

MD5: fca938ca93fe7c8f92bdf23c9a5a54c9 SHA-1: 86019616b0604f4b3e7b60c25da443fdfeef14a9 SHA-256: 6f721e74a6939cb9ed228e6c02a4804d330b64083e4efaead5be2f658bf1282a

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1204.002 Malicious File

The file contains an embedded OLE object, specifically identified as a Microsoft Equation Editor object. This object exhibits anomalies in its Ole10Native stream, suggesting it carries a malicious payload. The presence of an Equation Editor exploit points towards a delivery mechanism commonly used to execute arbitrary code, likely leading to a second-stage download or execution.

Heuristics 3

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/wQyIXeZzI.2D contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY

Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `4db13e7c8a65a42feade81601f7d2c64ba94d83e6da00e7ed0672c0da554fc1e`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/wQyIXeZzI.2D	928768 bytes
`ooxml_oleobject_00_ole10native_00.bin` `35b2c3685fd94af5d97585d6e163db7ade40ce3c8e40253955749a02888897e1`	ole-package	OOXML xl/embeddings/wQyIXeZzI.2D Ole10Native stream: olE10naTiVe	918535 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.