Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 b951d373ad9a9076…

MALICIOUS

Office (OOXML) / .XLSX

717.2 KB Created: 2010-06-04 08:55:28 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2022-08-15
MD5: efc6761d80400ce0d39f4e8045f66b07 SHA-1: 92baf9559588b9d6c411102d6b031e53701b99c4 SHA-256: b951d373ad9a9076d864d84a388322c1b485db4f1614250680a3b1a5eec6f9af
100 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The file is an OOXML document containing an embedded OLE object, specifically identified as an Equation Editor object. Heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous size difference, strongly suggesting it's a dropper for malicious content. The document body, formatted as a purchase order, serves as a lure to encourage interaction with the embedded object.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/zthvgq1gX.7GTbqR contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
c22d8e083b54b775bbaf02e91dee4a39e18518bee2ca8ed43adc9ed86a05a7d5		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/zthvgq1gX.7GTbqR 1030144 bytes
ooxml_oleobject_00_ole10native_00.bin
2231a625b9fafa4f85aa39ef7d232739ac8aebb65a59b39919de084d954aa97b		 ole-package OOXML xl/embeddings/zthvgq1gX.7GTbqR Ole10Native stream: OLE10natIVe 1019520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.