ZxxZDownloader Office (OOXML) / .XLSX malware analysis — malicious · ce922a20a73182c1

MALICIOUS

Office (OOXML) / .XLSX

11.2 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2022-05-13

MD5: bf51119c8b0673a9cfee1c384d1e236a SHA-1: 3d540373b74ed12df6b21e1ea21566907fba04a1 SHA-256: ce922a20a73182c18101dae7e5acfc240deb43c1007709c20ea74c1dd35d2b12

180 Risk Score

Malware Insights

ZxxZDownloader · confidence 95%

MITRE ATT&CK

T1204 Malicious File T1204.002 Malicious File: User Execution

The critical ClamAV heuristic firings, specifically 'Ole2.Exploit.ZxxZDownloader-9944376-0', indicate that this file is a known downloader exploiting a vulnerability in the Equation Editor OLE object. This suggests the file's primary purpose is to download and execute a secondary malicious payload. The embedded OLE object is the primary vector for this exploit.

Heuristics 4

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ole2.Exploit.ZxxZDownloader-9944376-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `bd0d25194634b2c74188cfa3be6668590e564e6fe26a6fe3335f95cbc943ce1d`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	6656 bytes
Detection ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 Obfuscation or payload: unlikely
`ooxml_oleobject_01.bin` `3992d5a725126952f61b27d43bd4e03afa5fa4a694dca7cf8bbf555448795cd6`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject2.bin	6656 bytes
Detection ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 Obfuscation or payload: unlikely
`emf_00.emf` `60ca1ffcf67457bab82b81f21ee94ca947dc99c8a077df1398db489a7cee22b5`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	6040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.