Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 bd6e6ec9f2e52cbc…

MALICIOUS

Office (OOXML) / .XLSX

830.5 KB Created: 2022-05-16 17:34:45 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-11-15
MD5: c5be4ef929c2be67ca8301eacac8d42c SHA-1: cbe1ad2683b9a5995073e4078da4ce060065e861 SHA-256: bd6e6ec9f2e52cbc6f312b66d9c40d79d981c204225070698bd8e81d5e3ab9b7
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The critical ClamAV heuristic and high-severity heuristics for an Equation Editor OLE object carrying a payload strongly suggest this XLSX file is a downloader. The embedded OLE object, specifically the Ole10Native stream within the Equation Editor, is anomalous and indicative of malicious intent. This points to a likely attack pattern involving a malicious attachment designed to deliver a secondary payload.

Heuristics 4

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/rKgzvn.rk9 contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • ClamAV: Xls.Downloader.Trojan-aa0b8f388d8573cd-aa0b8f388d8573cd-9950439-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Trojan-aa0b8f388d8573cd-aa0b8f388d8573cd-9950439-0
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
0034ff1947bf5b365edcdc1f258d4a0744c8858ea27cf7a84ba0ef65975c2331		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/rKgzvn.rk9 1021440 bytes
ooxml_oleobject_00_ole10native_00.bin
cb814166db6832bbc483a86b064459fb95163dd7a8210b5a501ff0ac736a0f98		 ole-package OOXML xl/embeddings/rKgzvn.rk9 Ole10Native stream: OlE10NAtIVe 1010829 bytes
emf_00.emf
38f17a599ac5d645df3840bbb401710ef81573a747da20abbfc1b7d9a9273b58		 ooxml-emf OOXML EMF part: xl/media/image1.emf 169096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.