Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 76b3f9676566041b…

MALICIOUS

Office (OLE) / .XLSX

88.1 KB First seen: 2022-04-30
MD5: 55f19c84cfc2767a8e61d4901776627b SHA-1: 3f45e6b0793c131f3b5643631d1a0a34bb223e50 SHA-256: 76b3f9676566041b2c957b1ce970bd50b967e20aeff7eb47b4cafb806e0c7fed
140 Risk Score

Malware Insights

MITRE ATT&CK
T1564.003 Obfuscated Files or Information: Hidden Files

The sample is an OOXML document that is encrypted with a default password and exhibits malformed structure, indicating an attempt to hinder analysis. The encryption and malformed nature are strong indicators of malicious intent, likely to conceal a malicious payload or evade detection mechanisms. No specific payload or execution method could be determined due to the heavy obfuscation.

Heuristics 4

  • Encrypted Office package with CFB FAT corruption critical OLE_ENCRYPTED_AND_MALFORMED
    Encrypted-package shape co-occurs with FAT-chain corruption — the documented combined evasion form.
  • Encrypted Office package with non-block-aligned cipher high OFFICE_ENCRYPTED_PACKAGE_MALFORMED
    EncryptedPackage cipher body is 85,565 bytes — not a multiple of the 16-byte AES block size.
  • Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGE
    OLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).
  • Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXML
    OLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.

Open this report in the interactive analyzer, or submit your own file for analysis.