Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 f1155b6e6f324fb8…

MALICIOUS

Office (OOXML) / .XLSX

1.27 MB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 12.0000
MD5: 6ddca61121562a4752480778dfc3db2a SHA-1: 22695b7009e70dd3cf0c61f898a4c6a7d57f6c19 SHA-256: f1155b6e6f324fb848f00d743ce0e1fb0899163fc651b79261d65feb79342a4c
110 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1559.001 Component Object Model Hijacking

The sample is an Excel file containing an embedded Equation Editor OLE object. Heuristics indicate that this object carries a payload-like Ole10Native stream with an anomalous size, suggesting exploitation of a vulnerability within the Equation Editor. The presence of hidden sheets further supports the concealment of malicious content. The primary attack vector appears to be exploiting the Equation Editor to achieve arbitrary code execution.

Heuristics 5

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.day.com/dam/1.0
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/tiff/1.0/
    • http://purl.org/dc/elements/1.1/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
317fad66308e7f0756b6c14be98257eec59a76d723ac8b997d98caf88218dcf6		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 1015808 bytes
ooxml_oleobject_00_ole10native_00.bin
41a85035637139ac24084342a1f3013c09c4ff0dde4b775b34ea0d537ccfdccd		 ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: ole10NatIVE 1005176 bytes
ooxml_oleobject_01.bin
4fda17fcc1d19283a707b710250d5d95974e6f015093579f513e4f6c37cfcd0e		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 10240 bytes
ooxml_oleobject_01_ole10native_00.bin
59fb77315591a55324873430963abffa12244adc4996302250a87d8a758a5796		 ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 8667 bytes
emf_00.emf
778a14d8c49a420d6a6697c58e975c02499b77b97843fe7b1a41245b57bdb15c		 ooxml-emf OOXML EMF part: xl/media/image10.emf 648132 bytes
emf_01.emf
d041ba0aa765a3c95237414abac4b72a1a4e17634cf13b688d8374e42514d401		 ooxml-emf OOXML EMF part: xl/media/image11.emf 7608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.