Formbook — Office (OLE) / .XLSX malware analysis

Static analysis result for SHA-256 bd6338e5fec330a4…

MALICIOUS

Office (OLE) / .XLSX

223.6 KB First seen: 2022-05-16
MD5: 17b36c462ac02a6b5b33a520f1b73cd9 SHA-1: e06b444330465342a8ef7684303cb49652431707 SHA-256: bd6338e5fec330a4521f2ec125eba452b0e1254ddec5ca7cfbd0a03316c7842f
240 Risk Score

Malware Insights

Formbook · confidence 95%

MITRE ATT&CK
T1204 Malicious File T1559.001 Component Object Model Hijacking

The file is a password-encrypted Excel spreadsheet that leverages an embedded Equation Editor OLE object, a known exploit carrier. ClamAV identifies the sample as Doc.Downloader.Formbook, indicating it likely functions as a downloader for the Formbook banking trojan. The encryption and malformed structure further suggest an attempt to evade static analysis.

Heuristics 6

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Default-encrypted OOXML embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Encrypted Office package with CFB FAT corruption critical OLE_ENCRYPTED_AND_MALFORMED
    Encrypted-package shape co-occurs with FAT-chain corruption — the documented combined evasion form.
  • ClamAV: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0
  • Default-encrypted OOXML exploit carrier layout high OOXML_ENCRYPTED_EXPLOIT_CARRIER_SHAPE
    Default-password encrypted OOXML package contains embedded OLE object parts and additional activation/decoy parts. This layout is common in malicious Excel exploit delivery and requires inspecting the decrypted package.
  • Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGE
    OLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).
  • Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXML
    OLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.