Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f8d58afee072f20a…

MALICIOUS

Office (OOXML)

789.9 KB Created: 2004-09-16 12:33:58 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2021-07-02
MD5: a08a7bd03dc2b3ba1fde1159c3a5bd16 SHA-1: 6fa07b9da112c65cb9810ff02da3e6340e5a9f30 SHA-256: f8d58afee072f20a191e450f60ff51c278d07eb543ee853021c669c02e202d69
100 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample contains a high-severity heuristic indicating an embedded Equation Editor OLE object that carries a payload-like Ole10Native stream. This strongly suggests the document is designed to exploit a vulnerability within the Equation Editor to execute arbitrary code. The presence of an embedded OLE object and the nature of the exploit point towards a spearphishing attachment delivery method.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/PbfUBz.4kl contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/PbfUBz.4kl 1058816 bytes
SHA-256: 12c489d7d1b7004f6350057b68394aa2bb75750d2d36364e49d4114624b43193
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/PbfUBz.4kl Ole10Native stream: olE10NAtiVe 1047912 bytes
SHA-256: 0b5a92b8a2a92d4331b9946a7ddf14687f35482e108c9f0ce0d73569916c388c

Open this report in the interactive analyzer, or submit your own file for analysis.