Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 b94ec322912fb358…

MALICIOUS

Office (OLE) / .XLSX

229.1 KB
MD5: 2983133e98fb409fa5aaa175df132696 SHA-1: 54b20dcddc3fdc2d6b35a93159b7738cb42c6f50 SHA-256: b94ec322912fb3585968d01b21a8afac8e06dfc54271697c44b0e80d108c9869
180 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 User Execution: Malicious File T1068 Exploitation for Privilege Escalation T1203 Exploit for Client Execution

The sample is a password-encrypted Office document using the default VelvetSweatshop password, a common technique to bypass static analysis. It contains an embedded OLE object (xl/embeddings/oleObject1.bin) that triggers an Equation Editor exploit, as indicated by the OLE_EQUATION_EDITOR heuristic. The CFB FAT corruption (OLE_ENCRYPTED_AND_MALFORMED) is likely intended to further evade detection and further confuse analysis tools.

Heuristics 5

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Default-encrypted OOXML embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Encrypted Office package with CFB FAT corruption critical OLE_ENCRYPTED_AND_MALFORMED
    Encrypted-package shape co-occurs with FAT-chain corruption — the documented combined evasion form.
  • Default-encrypted OOXML exploit carrier layout high OOXML_ENCRYPTED_EXPLOIT_CARRIER_SHAPE
    Default-password encrypted OOXML package contains embedded OLE object parts and additional activation/decoy parts. This layout is common in malicious Excel exploit delivery and requires inspecting the decrypted package.
  • Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGE
    OLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).
  • Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXML
    OLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.