Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 8d390f3472d97562…

MALICIOUS

Office (OLE) / .XLS

1.08 MB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2022-11-30
MD5: dab92cca348c26baff474d8295bbb677 SHA-1: 8a8dab6c00a5e166d2b96250978e0a915b33b4c2 SHA-256: 8d390f3472d975621d243c3ad67b55cde2599fd6d9a940e80b8fb4809b583505
108 Risk Score

Malware Insights

MITRE ATT&CK
T1200 Hardware Add-in T1059.005 Visual Basic

The critical heuristic firing for CVE_2017_11882_EQUATION_OLE10NATIVE indicates the exploitation of a known vulnerability in the Equation Editor component. This suggests the file is designed to leverage this flaw to execute arbitrary code. The presence of VBA macros, though not containing executable statements directly, is common in documents used for exploitation.

Heuristics 3

  • Equation Editor Ole10Native payload — CVE-2017-11882 critical CVE likely CVE_2017_11882_EQUATION_OLE10NATIVE
    An embedded Microsoft Equation 3.0 object (CLSID 0002CE02-0000-0000-C000-000000000046) carries an Ole10Native packager stream instead of the normal Equation Native/MTEF data. This is the weaponized Equation Editor RCE delivery shape used by CVE-2017-11882 / CVE-2018-0802 maldocs. The payload (font-record overflow + shellcode) is frequently encrypted and the stream name case-scrambled to evade scanners, but an Equation object holding an Ole10Native stream has no benign use.
  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
ed8da65f0f0a4cc2a905cfcf1ae916bf05ced375ebeefae9a837c8bf84ad6699		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 3618 bytes
ole10native_00.bin
e1c77acfbe17a4ebf5a8e8d4a637b2c9514c57188830cb8c1a6f6ed32188fcfc		 ole-package OLE Ole10Native stream: MBD01872A29/ole10NATiVE 1389 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.