Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 fbf53ebacdc9ef0b…

MALICIOUS

Office (OOXML) / .XLSX

626.0 KB Created: 2010-06-04 08:55:28 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2022-03-23
MD5: 6e80d37d14fbf49bb7d5f34656c62c60 SHA-1: 4a1a7ebb2b1ce84de103ccd9d0e2af00eeb00f16 SHA-256: fbf53ebacdc9ef0bf5833a25b50b3f4769e8f6ae7f565ce4520888747df8b729
100 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The sample is an Office document containing an embedded OLE object, specifically identified as an Equation Editor object. Heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous header, suggesting it's being used to deliver malicious content. The document body presents a purchase order, likely intended to trick the user into opening the malicious embedded object. No scripts were extracted from this sample.

Heuristics 3

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/e2.p94tA contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALY
    Embedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin
a926ec4e3b6fded36379332d75e65e6611d01b382d277aac422e7a82190257b2		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/e2.p94tA 854528 bytes
ooxml_oleobject_00_ole10native_00.bin
6bf36b615a4b5eef54fd81e8336ff60d855003588deb323e64b22488906cb4ad		 ole-package OOXML xl/embeddings/e2.p94tA Ole10Native stream: ole10nATIvE 844871 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.