Office (OOXML) / .XLSX malware analysis — malicious · 9bdcc4105c443758

MALICIOUS

Office (OOXML) / .XLSX

2.03 MB Created: 2025-07-23 07:56:53 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2025-07-30

MD5: efedb075240468a62a486eec9df0d0bd SHA-1: 9dc0423abef0444cf462892b93caa9ea36058167 SHA-256: 9bdcc4105c443758d1917d3f0bdd5705a42a95e65751f037ea4041b0c4a34849

120 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 User Execution: Malicious File T1559.001 Component Object Model Hijacking

The file is an Office document containing an embedded OLE object, specifically identified as an Equation Editor object. Critical heuristic firings indicate the presence of the CVE-2017-11882 vulnerability, which is known to be exploited via crafted OLE objects to achieve arbitrary code execution. The document body appears to be garbled or truncated, but the presence of the exploit is sufficient evidence for a malicious classification. The embedded OLE object itself is a key indicator.

Heuristics 3

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/J7N.5xW contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `bd9f6f24fe1d9678287fa3d32d40de390ec7c0d3f5ab69d7fa8cfe985cc0fdbc`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/J7N.5xW	2880000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.