Office (OOXML) / .XLSX malware analysis — malicious · bfc29b5d39da0444

MALICIOUS

Office (OOXML) / .XLSX

674.9 KB Created: 2020-05-18 06:42:12 UTC Authoring application: Microsoft Excel 15.0300

MD5: 391587e91ff22a80d414b9eb0153f6c6 SHA-1: d174fdbe9e4df312b6f29a60b5f7fea2deeed78d SHA-256: bfc29b5d39da04448d2b2f732cbfaa56c0263d0c7061ff8889103b68af6793e0

120 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1559.001 Component Object Model

The critical heuristic firing for CVE-2017-11882 indicates the exploitation of a known vulnerability in Microsoft Equation Editor. This is further supported by the presence of an embedded OLE object, specifically identified as an Equation Editor object. The exploit likely leverages this object to execute arbitrary code, leading to the malicious verdict. No scripts were extracted, and the document body content appears to be unrelated tabular data, suggesting the exploit is the primary malicious mechanism.

Heuristics 3

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/GluQCQm.7dO6F contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `149afc5cfb733efa75a2fdeb98240fa1f2b24bcf16d87c027660caf23a307686`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/GluQCQm.7dO6F	859648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.