Office (OOXML) malware analysis — malicious · e1fa8dbee147b66b

MALICIOUS

Office (OOXML)

1.39 MB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2021-05-23

MD5: 99406e545c5424009773bb767405f151 SHA-1: a794518cdb38fc12a28cd8f0938d0eeddcf17959 SHA-256: e1fa8dbee147b66b9a4d5b2c51811bf11d7c9035017eb6440b050f3763310dc9

132 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an OOXML file containing an embedded OLE object, specifically identified as a Microsoft Equation Editor exploit. This exploit likely downloads a second-stage payload from the URL http://www.day.com/dam/1.0. The presence of high-entropy carved artifacts and a suspicious Ole10Native stream further supports the malicious nature of the embedded object.

Heuristics 7

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY

Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL

An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.day.com/dam/1.0 In document text (OOXML body / shared strings)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OOXML body / shared strings)
- http://ns.adobe.com/tiff/1.0/In document text (OOXML body / shared strings)
- http://purl.org/dc/elements/1.1/In document text (OOXML body / shared strings)

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject2.bin	3700224 bytes
SHA-256: `099285fef2ed11db5f9df233c6ced91fabd135a95895baa6ced071995f89fc5f`
`ooxml_oleobject_00_ole10native_00.bin`	ole-package	OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native	3668580 bytes
SHA-256: `079553d7ab4785a82155c9ad8a77bb8aac84989e54fd6ba4892bc43e2c43717b`
`ooxml_oleobject_01.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	1009152 bytes
SHA-256: `30335669035165c841da36e520efaac272246ad8c25d717941a08a1bb655f302`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL
`ooxml_oleobject_01_ole10native_00.bin`	ole-package	OOXML xl/embeddings/oleObject1.bin Ole10Native stream: oLe10nAtive	998552 bytes
SHA-256: `e16e24b06cd5f1fcd544b3d01479f5408ac3d595a89b1520ea168ae9f1ad6dde`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL
`ooxml_oleobject_02.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject3.bin	29696 bytes
SHA-256: `7792b56d4a3f1890891484007be6930d671866c72d184d4b3ee33129b65bd583`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.46, consistent with packed or encrypted content.
`ooxml_oleobject_02_ole10native_00.bin`	ole-package	OOXML xl/embeddings/oleObject3.bin Ole10Native stream: Ole10Native	28007 bytes
SHA-256: `d0e65243df358f9ee7948eadb2c9e55da3344dd9a0ee3fcc11d3188c924dc972`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.61, consistent with packed or encrypted content.
`ooxml_oleobject_03.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Office_Word_Macro-Enabled_Document1.docm	127577 bytes
SHA-256: `860e3a444213746b9912e46bc202730ce44fad6bc1e7ec22d95eefe7a34f6435`
`emf_00.emf`	ooxml-emf	OOXML EMF part: xl/media/image2.emf	7337552 bytes
SHA-256: `483bccb76820466fffb1bb06d3436d7b79b48f600cca539fd2f514120cd08d78`
`emf_01.emf`	ooxml-emf	OOXML EMF part: xl/media/image3.emf	5376 bytes
SHA-256: `469c74269e2d1bdc73963fe900889e51b053163390ae7ca307eb36938ad92518`
`emf_02.emf`	ooxml-emf	OOXML EMF part: xl/media/image4.emf	653280 bytes
SHA-256: `ee8db1aaee6c32b6c95c3cfcf951354c574370b6666daf820c35b442c5fc4376`

Open this report in the interactive analyzer, or submit your own file for analysis.