Office (OOXML) / .XLSX malware analysis — malicious · b465f8c6461cdd1c

MALICIOUS

Office (OOXML) / .XLSX

2.02 MB Created: 2025-05-15 01:02:55 UTC Authoring application: Microsoft Excel 12.0000

MD5: caf57f22717d257b0c4c80294457d65a SHA-1: 9ef429519ee58c27a13fbcaadc89abdc142ecaeb SHA-256: b465f8c6461cdd1cc2e4243a3873fb8729a3b29da530a5cb9556bede3fd55a77

160 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1559.001 Component Object Model Hijacking

The sample is a malicious Excel file containing an embedded OLE object, specifically identified as an Equation Editor object. High-severity heuristics indicate the presence of a NOP sled and a critical vulnerability, CVE-2017-11882, which is exploited through a FONT record overflow within the Equation Editor. This exploit allows for arbitrary code execution. The embedded OLE object is the primary vector for this attack.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/KB9y2.GmW contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
NOP sled detected high SC_NOP_SLED

Found 20+ consecutive 0x90 bytes
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `2fe4ebc507d7bd91235f81e13f47e5fa2ea2737bc9d46fdd06eed1047570cd3c`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/KB9y2.GmW	2874368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.