MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1559.001 Component Object Model Hijacking
T1204.002 Malicious File
The file is an Office document containing an embedded OLE object, specifically identified as a Microsoft Equation Editor object. Heuristics indicate that this Equation Editor object carries a payload-like Ole10Native stream with an anomalous header, suggesting it's being used to deliver malicious content. The large declared inner size compared to the stream size further supports this. This technique is commonly used to exploit vulnerabilities in the Equation Editor to execute arbitrary code.
Heuristics 3
-
Equation Editor OLE object high OLE_EQUATION_EDITOREmbedded OLE object xl/embeddings/oV.E5 contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
-
Equation Editor object carries payload-like Ole10Native stream high OLE_EQUATION_OLE10NATIVE_PAYLOAD_ANOMALYEmbedded OLE object declares the Equation Editor CLSID but stores a large high-entropy Ole10Native stream with malformed package sizing. This is an exploit-shaped Equation/OLE payload container seen in malicious OOXML samples. It is not assigned to a specific CVE unless the MTEF/Equation Native primitive also matches.
-
Embedded OLE object medium OOXML_OLE_OBJECTDocument contains an embedded OLE object
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
ooxml_oleobject_00.bin20f20e5e409f6fec9f368808e742b15d89f83cdd6bfc951c868ab178fc54ad42 |
ooxml-ole-object | OOXML embedded OLE part: xl/embeddings/oV.E5 | 934912 bytes |
ooxml_oleobject_00_ole10native_00.bin334e831711c1cd95a247417274fb8921614b6b2a36c385f10e6d01b0de3985a4 |
ole-package | OOXML xl/embeddings/oV.E5 Ole10Native stream: Ole10Native | 924700 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.