Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 c81bd43d5985cb37…

MALICIOUS

Office (OLE) / .XLSX

1.22 MB
MD5: 7705b3b2ec5ad61d89fe00e255986b09 SHA-1: 1433685823d14ea88e3878225fc9833e1e34ceab SHA-256: c81bd43d5985cb37be7dc8d4375c2e6ab8998f3962c185a3997d71aba79cf23b
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an encrypted Office OOXML file that contains embedded OLE objects, specifically identified as an Equation Editor exploit carrier. This strongly suggests it is designed to exploit the Equation Editor vulnerability (CVE-2017-11882) when opened. The encryption with a default password is a common technique to evade static analysis.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Default-encrypted OOXML embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Default-encrypted OOXML exploit carrier layout high OOXML_ENCRYPTED_EXPLOIT_CARRIER_SHAPE
    Default-password encrypted OOXML package contains embedded OLE object parts and additional activation/decoy parts. This layout is common in malicious Excel exploit delivery and requires inspecting the decrypted package.
  • Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXML
    OLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.