Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 777f799d21a1cc3a…

MALICIOUS

Office (OOXML) / .XLSX

700.2 KB Created: 2022-08-10 18:51:50 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2024-08-06
MD5: babb4de40848e81596492cb447daf979 SHA-1: 792d70c3f4b652660373b3abea10d2976a092ad2 SHA-256: 777f799d21a1cc3a5d46e53844f56f1b75f8d9ec6f70377755e236a12c4aa4a7
100 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The sample contains an embedded OLE object, specifically identified as an Equation Editor object. This object exhibits anomalies in its Ole10Native stream, indicating it carries a payload. The document body is formatted as a purchase order, likely a lure to trick users into opening the malicious content. The presence of an Equation Editor OLE object strongly suggests exploitation of CVE-2017-11882 or a similar vulnerability.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/9gv5cxJc.NkZtP contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
c237858e76c8dc509d20195498aebd6ec7647814e4a989975e3a2ac53c76bafd		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/9gv5cxJc.NkZtP 1035776 bytes
ooxml_oleobject_00_ole10native_00.bin
5b8dc1686dc88f4e316d44f2024dede29ed87e50f2ef7f0ec5aa2b32640d0d84		 ole-package OOXML xl/embeddings/9gv5cxJc.NkZtP Ole10Native stream: Ole10NATiVE 1025326 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.