Office (OOXML) / .XLSX malware analysis — malicious · 9be087ce6813d26b

MALICIOUS

Office (OOXML) / .XLSX

3.25 MB Created: 2025-10-08 01:54:00 UTC Authoring application: Microsoft Excel 12.0000

MD5: 9cf470377ab5f320790294d5ce351535 SHA-1: 7a29fe20a3c40cfb55c09d00e8496e532b3586dc SHA-256: 9be087ce6813d26b0fd9524f8f43ec5de8bea5ea1b3a835acd390889c2816184

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing via Service

The sample is an OOXML document containing an embedded OLE object, specifically identified as an Equation Editor object. Heuristics indicate a lure to enable macros, a common technique for malware droppers. The embedded OLE object is a significant indicator of malicious intent, often used to deliver exploits.

Heuristics 3

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/9U7mlsYu.AS6JCHB contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `4e0ba3fbe603ddb961424808c829e3001a9f5a91d034fe8167d067e33e01171f`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/9U7mlsYu.AS6JCHB	2810880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.