Office (OOXML) / .XLSX malware analysis — malicious · cd2cb936e95479be

MALICIOUS

Office (OOXML) / .XLSX

630.5 KB Created: 2023-06-30 16:55:44 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2023-08-01

MD5: 6350a1761df3bdb4043944308d064193 SHA-1: 41558882b233ecc62a9f8fca89fac46d1a357f51 SHA-256: cd2cb936e95479be3ae468d5390a8b6e94b84c76a129a91923ade7f6c751cac6

100 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The sample is an OOXML file containing an embedded OLE object, specifically identified as a Microsoft Equation Editor object. Heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous header and size, strongly suggesting it's being used to exploit a vulnerability. The document body appears to be financial transaction data, which could be a lure to disguise the malicious intent of the embedded exploit.

Heuristics 3

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/fivDlHy1.hs88H9 contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY

Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `04cb63bebff69efdaf895e6867fbca8079886150812564193f683010d85ebde3`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/fivDlHy1.hs88H9	920576 bytes
`ooxml_oleobject_00_ole10native_00.bin` `d831b18e36d3d4f06f89bd804ca8b32bcb21f9f389428efb00d267721892d666`	ole-package	OOXML xl/embeddings/fivDlHy1.hs88H9 Ole10Native stream: oLe10natIvE	910681 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.