ZxxZDownloader Office (OOXML) / .XLSX malware analysis — malicious · b7765ff16309baac

MALICIOUS

Office (OOXML) / .XLSX

11.2 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2022-05-13

MD5: 527dc131149644af439e0e8f96a2c4eb SHA-1: 3ba50221785aa8d1f2dea2894fc9a9449e826724 SHA-256: b7765ff16309baacff3b19d1a1a5dd7850a1640392f64f19353e8a608b5a28c5

180 Risk Score

Malware Insights

ZxxZDownloader · confidence 95%

MITRE ATT&CK

T1204 Malicious File Execution T1059 Command and Scripting Interpreter

The critical ClamAV detections indicate this file is a known downloader, specifically Ole2.Exploit.ZxxZDownloader-9944376-0. The presence of an embedded Equation Editor OLE object strongly suggests exploitation of a vulnerability within that component to facilitate the download and execution of a secondary payload. This aligns with common delivery techniques for this family.

Heuristics 4

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject2.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ole2.Exploit.ZxxZDownloader-9944376-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `56b462ed97e6f8cec441fca83091cae59eea1a7ae893711e7c58488d0be73caa`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject2.bin	6656 bytes
Detection ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 Obfuscation or payload: unlikely
`ooxml_oleobject_01.bin` `bcceaa857f40ff063a51f957bcb086a1a2b15787de4a6744f42482e1c3d0d861`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	6656 bytes
Detection ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 Obfuscation or payload: unlikely
`emf_00.emf` `60ca1ffcf67457bab82b81f21ee94ca947dc99c8a077df1398db489a7cee22b5`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	6040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.