Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 90576dc5b303e038…

MALICIOUS

Office (OOXML) / .XLSX

738.2 KB Created: 2023-09-27 08:05:40 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2023-10-05
MD5: 3941800d406b92f0b717c1d28408b63a SHA-1: f8751d2a6f25551106a14394dd23c28e8b29ca53 SHA-256: 90576dc5b303e038d3cd2d2ef651d57cf8286707bd8d5888ae73ee7bd9dfcc62
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The file is an OOXML document containing an embedded OLE object, specifically identified as an Equation Editor object. High-severity heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous header and size discrepancy, strongly suggesting it's designed to execute malicious code. The embedded OLE object is the primary mechanism for delivering the malicious payload.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/Atj2sSCV7.YJIxqXh contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
e0d4a85766d2c93101698a2777c7555ab7843fdb2ab64fa8d97e1d942e374532		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/Atj2sSCV7.YJIxqXh 1056768 bytes
ooxml_oleobject_00_ole10native_00.bin
5496e040b5d68563bef58b7eff6bc919b18042422b9581dea64ea77b289185c9		 ole-package OOXML xl/embeddings/Atj2sSCV7.YJIxqXh Ole10Native stream: oLE10NaTivE 1045735 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.