Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d9dbc7f37f626fdb…

MALICIOUS

Office (OOXML)

1.36 MB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2021-05-22
MD5: 723b2ae7e3c693002fb0aee536c2c9f3 SHA-1: 78ae138abb1dd66449525b6342db3ed41726bd5a SHA-256: d9dbc7f37f626fdb270a2d71eb11e97abfaa0c46abed124d4c0aafa1b9773f0c
114 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an Excel document containing an embedded OLE object, specifically identified as a Microsoft Equation Editor object. This object exhibits anomalies indicative of a payload, with a high-entropy Ole10Native stream. The heuristic firings strongly suggest this object is used to exploit a vulnerability, likely for client execution, and attempts to download a payload from the URL http://www.day.com/dam/1.0. The presence of a hidden sheet further supports the concealment of malicious activity.

Heuristics 7

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.day.com/dam/1.0 In document text (OOXML body / shared strings)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
    • http://ns.adobe.com/tiff/1.0/In document text (OOXML body / shared strings)
    • http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 1029632 bytes
SHA-256: e3b83ce57ba4e8cff9eef440fc40970dd8d80e96d544e835f8b4ecd787cd91b0
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: olE10NAtIVe 1018939 bytes
SHA-256: 0aa7e7d7379a40194446cb444738fdd298bc59804ca1865f6a14e46b4bcd41d9
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 29696 bytes
SHA-256: b4a3c679094adafc4d944aa6c4ab029a02dcc3f713a689c7e94cf162f979e1b6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.46, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject3.bin Ole10Native stream: Ole10Native 28007 bytes
SHA-256: d0e65243df358f9ee7948eadb2c9e55da3344dd9a0ee3fcc11d3188c924dc972
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.61, consistent with packed or encrypted content.
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 3700224 bytes
SHA-256: ab9a1964ad5b459c778cea58a00666bce5f6954f0fcc61a74804e0114bbecd6f
ooxml_oleobject_02_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 3668580 bytes
SHA-256: 079553d7ab4785a82155c9ad8a77bb8aac84989e54fd6ba4892bc43e2c43717b
ooxml_oleobject_03.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/Microsoft_Office_Word_Macro-Enabled_Document1.docm 127579 bytes
SHA-256: ce8b781d23e53ef3cad271001bcb887f1cae3bfd2a2d36e37ef13a8cf5ea7d74
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 7337552 bytes
SHA-256: 483bccb76820466fffb1bb06d3436d7b79b48f600cca539fd2f514120cd08d78
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image3.emf 5376 bytes
SHA-256: 2cd55f5ae52519b2d1133faf7bd844a860996a852697d2d90b9a83adc75f31b2
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image4.emf 653280 bytes
SHA-256: f6a1e8ef26d84effb533edce794e118d342fe0951e73908173d986758bf7c64d

Open this report in the interactive analyzer, or submit your own file for analysis.