Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 ad9a2b321cc1f853…

MALICIOUS

Office (OOXML) / .XLSX

3.61 MB Created: 2025-10-08 01:54:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2026-06-26
MD5: b8f2ebcf02ea7e0b5ce220e92a19b487 SHA-1: b4b6b1219c57e9d62fbe380bf442943702f6ca09 SHA-256: ad9a2b321cc1f85387fd7e8c763e1a97c3fe706673e0a1e181a63d368a6f1f0d
80 Risk Score

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/DwSlWeh.SZyZU1 contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/DwSlWeh.SZyZU1 2930176 bytes
SHA-256: 8b67865eabb93b31126a68f2c3fdc00fd5d97a3ae2e4ba60fb578d11f9bd593e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL

Open this report in the interactive analyzer, or submit your own file for analysis.