Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 9c31096b2ec56662…

MALICIOUS

Office (OOXML) / .XLSX

2.07 MB Created: 2025-06-12 01:12:31 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2026-01-07
MD5: dd353d8d5f63ca922f8161d81c12462b SHA-1: 82246cb6f5076dd717cbb5aaf71949df13b11d55 SHA-256: 9c31096b2ec5666284715a6011170a8a775d115a420c07d3aea469146985ca19
60 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking

The primary finding is a high-severity heuristic indicating an Equation Editor OLE object embedded within the XLSX file. This object is frequently exploited to deliver malicious payloads. The presence of this object strongly suggests an attempt to leverage known vulnerabilities within the Equation Editor component.

Heuristics 2

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/5aAcI5Qig.L4ScPeh contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
d71d4af74108b62e99aad4142a856b9648c8eaf7f598b00fb6441bf2ac73991a		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/5aAcI5Qig.L4ScPeh 2994688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.