Win.Trojan.Laroux-57 — Office (OLE) malware analysis

Static analysis result for SHA-256 0026a843b824b1c1…

MALICIOUS

Office (OLE)

80.5 KB Created: 1998-10-07 21:03:04 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 7306d7b1cbe4431786698e1ce44bc039 SHA-1: 56aed0c631bc3ad86bfc1a299329b68317349adb SHA-256: 0026a843b824b1c1c1fce308a5b0c69ec23b5738a414a9642f6f851adb6fe222
120 Risk Score

Malware Insights

Win.Trojan.Laroux-57 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a malicious Excel 5 macro-virus, specifically Win.Trojan.Laroux-57. The presence of 'laroux' and 'auto_open' markers within the OLE structure strongly indicates a macro-based threat. The document body contains heavily obfuscated and repetitive text, likely intended to obscure the malicious payload.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-57 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-57
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.