Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d0412682986d392b…

MALICIOUS

Office (OOXML)

14.8 KB Created: 1996-10-14 23:33:28 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2019-10-30
MD5: 73a1a7119c1fe2d065b4ba6000b48eea SHA-1: 954a4d82e886d0f2d3b3c65ad48911c30d9fb62f SHA-256: d0412682986d392b1e870e41315189933a5154235175ce85b49b4410ce80acdb
200 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is identified as malicious due to critical heuristic firings indicating the presence of the CVE-2017-11882 vulnerability within an embedded Equation Editor OLE object. The document body contains a lure to 'ENABLE EDITING' and 'ENABLE CONTENT', common tactics for macro-based malware. The embedded OLE object is specifically flagged by ClamAV as Doc.Exploit.CVE_2017_11882-6934206-0, strongly suggesting exploitation for client execution.

Heuristics 4

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Exploit.CVE_2017_11882-6934206-0
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 4096 bytes
SHA-256: 4486408fa229201635c750273fe87d67d530a4b65e760adc7335ae624efc4e44
Detection
ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.