Office (OOXML) / .XLSX malware analysis — malicious · ec9e656a7ef5791c

MALICIOUS

Office (OOXML) / .XLSX

10.3 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2022-05-13

MD5: f45f45a5ee8b4d31188139c1976167b2 SHA-1: 0a71ccacab3d5f66730791ecbe4e2030e8a21a89 SHA-256: ec9e656a7ef5791cc4f86d17140dd012a5154cd83419669e43785b6370a00b70

180 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious File T1059 Command and Scripting Interpreter

The critical ClamAV heuristic firings, specifically 'Ole2.Exploit.ZxxZDownloader-9944376-0', indicate that this file is a known exploit leveraging the Equation Editor OLE object. This technique is commonly used to download and execute a second-stage payload. The embedded OLE object and the ClamAV detection strongly suggest a malicious intent, likely a downloader.

Heuristics 4

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ole2.Exploit.ZxxZDownloader-9944376-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin` `c77f16601f3d6594dc598cb1115b148bb616f6fda0ebb8714f0b0004e09d780b`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/oleObject1.bin	6656 bytes
Detection ClamAV: Ole2.Exploit.ZxxZDownloader-9944376-0 Obfuscation or payload: unlikely
`emf_00.emf` `c2f962ded401fe1d00a71a8c4363129f7ffd4f184d997c6daa36d66560ddedf9`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	3614 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.