Office (OOXML) / .XLSX malware analysis — malicious · dc31ff13d1512af2

MALICIOUS

Office (OOXML) / .XLSX

722.2 KB Created: 2023-07-26 19:45:53 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2023-09-13

MD5: a54a3c6999575fee6d6e25733c5ff8f0 SHA-1: a360e83ff55a41be289f831ad5eb64319a579df3 SHA-256: dc31ff13d1512af2bcb1d0d93e8aabc483fcb8b282df0b3432f8772372a1cb09

100 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The high-severity heuristics indicate the presence of an embedded OLE object, specifically an Equation Editor object, that carries a payload-like Ole10Native stream. This structure is commonly exploited to execute arbitrary code. The anomaly in the declared inner size versus the stream size suggests a potential buffer overflow or data manipulation technique used for exploitation.

Heuristics 3

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/WD13.Rq contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY

Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `77ab59b1087dacc30b6392a52e7b71db8abfd7483c0e8be88fd8f807c148d27c`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/WD13.Rq	1005568 bytes
`ooxml_oleobject_00_ole10native_00.bin` `ce513feddb92fb6b0d39b888f36f78ee7a6041cc3fc16d2f77c6a9e43a701ef5`	ole-package	OOXML xl/embeddings/WD13.Rq Ole10Native stream: Ole10natIVe	994823 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.