Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 71335827ba9b5dc3…

MALICIOUS

Office (OLE) / .XLSX

914.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel
MD5: 59f852da6d7c61521baf6e4fc7180418 SHA-1: a7fbbcf85f5f7718b6ac45ad997156c4addba03a SHA-256: 71335827ba9b5dc34efaeb0bb4f4e5c24ec871ee93098697228435b5b85ccbb7
62 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is an Excel file that exploits CVE-2017-0199, a known vulnerability for remote code execution. The heuristic indicates it acts as a remote loader, downloading a payload from the provided URL. The document body is largely unreadable binary data, offering no further context on the lure.

Heuristics 2

  • OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199
    Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://12233877758876868788787567345685688@kutt.acorninsure.co.uk/5MGQ0Q

Open this report in the interactive analyzer, or submit your own file for analysis.