ZxxZDownloader Office (OOXML) / .XLSX malware analysis — malicious · b73638a6581af3c1

MALICIOUS

Office (OOXML) / .XLSX

11.6 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2022-05-13

MD5: 1f2ba324c566ba1f29e94971bc1034c8 SHA-1: 7f7139a9a0d437e8876520913a188321ba1c647c SHA-256: b73638a6581af3c173fb0d6214fd881ed131e8f7884c1be297c80ecba5989bd4

180 Risk Score

Malware Insights

ZxxZDownloader · confidence 95%

MITRE ATT&CK

T1204 Malicious File Execution T1204.001 Malicious File Execution: User Execution of Malicious Code

The critical ClamAV heuristic firings, specifically 'Ole2.Exploit.ZxxZDownloader-9944376-0', indicate that this file is a known downloader. The presence of an embedded Equation Editor OLE object is a strong indicator of exploitation of vulnerabilities within that component, commonly used to deliver second-stage malware. The file's purpose is to exploit this vulnerability to download and execute a further payload.

Heuristics 4

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ole2.Exploit.ZxxZDownloader-9944376-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `c77f16601f3d6594dc598cb1115b148bb616f6fda0ebb8714f0b0004e09d780b`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	6656 bytes
Detection ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 Obfuscation or payload: unlikely
`ooxml_oleobject_01.bin` `64aaaa12b3f6b74f40cdac5af36376126ad01e356fe151679e2ca7d45b18d270`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject2.bin	6656 bytes
Detection ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 Obfuscation or payload: unlikely
`emf_00.emf` `c2f962ded401fe1d00a71a8c4363129f7ffd4f184d997c6daa36d66560ddedf9`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	3614 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.