Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 7c9adcd97a872b16…

MALICIOUS

Office (OOXML)

1.89 MB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2021-05-23
MD5: ab150af39ca0cc33496e0919cf116c65 SHA-1: 86bb7e53e23e93f348c22fdee0b9b60658f7971c SHA-256: 7c9adcd97a872b16aa7db46f120e61a29c98449ee22fe291957cd6261164aff9
154 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an Excel document containing an embedded Equation Editor OLE object that exhibits anomalies indicative of CVE-2018-0798. This object likely contains shellcode designed to exploit the vulnerability and download a second-stage payload from the URL http://www.day.com/dam/1.0. The presence of hidden sheets further suggests an attempt to conceal malicious activity.

Heuristics 8

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • CVE-2018-0798 — anomalous Equation Editor native stream high CVE likely CVE_2018_0798_EQUATION_NATIVE_ANOMALY
    Embedded Equation Editor OLE data contains anomalous native stream bytes consistent with a CVE-2018-0798-style Equation Editor exploit. This is treated as likely CVE evidence because the Equation object is malformed and payload-like, but it does not match the exact public matrix-overflow byte signature.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.day.com/dam/1.0 In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/tiff/1.0/In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 30208 bytes
SHA-256: b06c37119d6f2f50ef1799e883e316d8f89a6944191229ec83c9bfabb30ba51e
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject3.bin Ole10Native stream: Ole10Native 28352 bytes
SHA-256: 03c796872534085c1ef306506a6f64ffbf41a3937ccf7e8c14a7a15fe17b70a5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.58, consistent with packed or encrypted content.
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 1549312 bytes
SHA-256: a7d92832fb06e110554be0d3f708f0bd44afcb7acfdd9da735908941cd8339c6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: olE10NaTiVE 1534582 bytes
SHA-256: 142a900bd39ef4318c69a380616048dcb20df4b4188a6e544e5f40a09c71af79
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 3700224 bytes
SHA-256: da2f5a508e1c02f435db90086efea7f5466d43884cc758f37850299ecb39d080
ooxml_oleobject_02_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 3668580 bytes
SHA-256: 079553d7ab4785a82155c9ad8a77bb8aac84989e54fd6ba4892bc43e2c43717b
ooxml_oleobject_03.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/Microsoft_Office_Word_Macro-Enabled_Document1.docm 122522 bytes
SHA-256: 49472a7c73c31ef481bc85be1396f0ff12ff27357bdef65effcb191ba6ebeb00
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 7337552 bytes
SHA-256: e47ca5b97dc4da34b3125e61d2ec840ef506be97561be73926c2dc459722b9e5
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image3.emf 7592 bytes
SHA-256: 2b9427ff719b966d39546e99dc77941f80db89f80dd32b98720e5f52266a4a11
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image4.emf 648132 bytes
SHA-256: 08059a3a27b3cc4a420d896d3465747a9ab205e63dae3a0ff6004b9f68f42cd5

Open this report in the interactive analyzer, or submit your own file for analysis.