Win.Trojan.Laroux-50 — Office (OLE) malware analysis

Static analysis result for SHA-256 0d7e500daed0c9a8…

MALICIOUS

Office (OLE)

39.5 KB Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: fbd5d41546d3fb2a4b81c6ef409c472f SHA-1: 3553cd7e4dd0e448b221f9ea15c9929878d03501 SHA-256: 0d7e500daed0c9a8eff1bf3f3c4c1d5388780e32f616c1521cc6b561c37df024
120 Risk Score

Malware Insights

Win.Trojan.Laroux-50 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a critical threat due to the presence of the OLE_XLS5_LAROUX_MACRO_VIRUS heuristic, indicating it's a variant of the Laroux macro virus. ClamAV also confirms this detection as Win.Trojan.Laroux-50. The document body contains garbled text and financial terms, likely a lure to disguise the malicious macro.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-50 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-50
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.