Office (OLE) / .XLSX malware analysis — malicious · e221d54c29eeb719

MALICIOUS

Office (OLE) / .XLSX

1.06 MB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2026-03-06

MD5: 95ccc733a6f72a1c614843b9b9ec8b0e SHA-1: ca115a37a554b815b40f4e1f1b1bf78da6432fa3 SHA-256: e221d54c29eeb7199eccbe8ce1984cae212ce37ee4e89559789f98890d88d2d2

62 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

The critical heuristic firing indicates exploitation of CVE-2017-0199 via an OLE2Link object, which attempts to load a remote resource from the URL http://0000000000000000013537720160/13333.php. This suggests the file acts as a dropper or downloader for a secondary malicious payload. No scripts were extracted from this sample.

Heuristics 2

OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199

Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://0000000000000000013537720160/13333.php

Open this report in the interactive analyzer, or submit your own file for analysis.