Laroux — Office (OLE) / .EXE malware analysis

Static analysis result for SHA-256 02f533e4596d4095…

MALICIOUS

Office (OLE) / .EXE

68.0 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel
MD5: 8842af0f203a8d1e4aeda6885a20844e SHA-1: 49c968bfaeef594361ca52512f01928406453cf7 SHA-256: 02f533e4596d4095a152236e46a63a36ee9c2d78d837130f12e208341384cf13
180 Risk Score

Malware Insights

Laroux · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The critical heuristic 'OLE_XLS5_LAROUX_MACRO_VIRUS' strongly indicates the presence of the Laroux macro-virus, a known threat associated with Excel 5. The presence of embedded Office documents and OLE structure anomalies further supports this classification. The file's purpose is likely to spread through macro execution within Microsoft Excel.

Heuristics 4

  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 63,894 bytes but its declared streams total only 0 bytes — 63,894 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_off0000166a.ole
a9ba2ce03b6dfdbb95bb7714f8133036e02dc0adf3a4033bbfd9128a30c66d71		 embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x166A 63894 bytes
embedded_office_off00003865.ole
5775984585063eff2fa24f059cb72ba658340e412699da6a75849f8d1b740ed7		 embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x3865 55195 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.