Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 af323ce0b08f9726…

MALICIOUS

Office (OOXML) / .XLSX

2.46 MB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000
MD5: 2c08e15ad516241558b3ccc383206fc7 SHA-1: f025effedd3015a8a4029c35c25bd25cf82bbc7b SHA-256: af323ce0b08f9726f0a0643fcd0a94e92f6e88037fcff7399a0b4ac1dff99e59
150 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1559 Component Object Model Hijacking T1559.001 Component Object Model Hijacking: Component Object Model Hijacking

The file is an Excel spreadsheet containing an embedded OLE object, specifically a Microsoft Equation Editor object. Heuristics indicate this object is anomalous and likely carries a payload, exploiting CVE-2018-0798. The embedded OLE object and its native stream are suspicious due to high entropy and anomalous headers, suggesting it's designed to execute arbitrary code. No document body or scripts were extracted, but the presence of the vulnerable Equation Editor component is a strong indicator of a malicious exploit.

Heuristics 6

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • CVE-2018-0798 — anomalous Equation Editor native stream high CVE likely CVE_2018_0798_EQUATION_NATIVE_ANOMALY
    Embedded Equation Editor OLE data contains anomalous native stream bytes consistent with a CVE-2018-0798-style Equation Editor exploit. This is treated as likely CVE evidence because the Equation object is malformed and payload-like, but it does not match the exact public matrix-overflow byte signature.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
    URL http://www.day.com/dam/1.0
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/tiff/1.0/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
7e836c1187445c4d362cc4098a074869fd7a5bfa7ac4f0699f94882bf6ef9b37		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 2020352 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_00_ole10native_00.bin
75ec853a23fd188a2b3001814641cfe2818750fe222d4d6870775d1c6d548813		 ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: oLE10natIvE 2002181 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.
emf_00.emf
d24dc87be29331cad1dda51467e5e17b088965f85ac6f2fbcb0c035769ca7615		 ooxml-emf OOXML EMF part: xl/media/image12.emf 653280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.