MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The file is an OOXML document containing an embedded OLE object, specifically identified as an Equation Editor. High-severity heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous header and size discrepancy, strongly suggesting it's designed to exploit a vulnerability and execute malicious code. The document body content appears to be financial data, likely a lure to encourage opening the embedded object.
Heuristics 3
-
Equation Editor OLE object high OLE_EQUATION_EDITOREmbedded OLE object xl/embeddings/1Hd7Brw.5Fm contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
-
Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALYEmbedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
-
Embedded OLE object medium OOXML_OLE_OBJECTDocument contains an embedded OLE object
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
ooxml_oleobject_00.bin0b8db65172818aec056afca96425bc5d96c014dfd995735405fab3d9986780f5 |
ooxml-ole-object | OOXML embedded OLE part: xl/embeddings/1Hd7Brw.5Fm | 998912 bytes |
ooxml_oleobject_00_ole10native_00.bin464ca8f0e2298ed50ad665d68059f9b29dd3e29655e4f0ed3f3fe85a770c4928 |
ole-package | OOXML xl/embeddings/1Hd7Brw.5Fm Ole10Native stream: olE10naTivE | 988607 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.