Office (OLE) / .PPT malware analysis — malicious · 10f2802bd456f559

MALICIOUS

Office (OLE) / .PPT

81.0 KB Created: 2021-07-16 10:44:52 Authoring application: Microsoft Office PowerPoint

MD5: a1e02ba6d5e1d45af35e61293c1c043e SHA-1: 68dfa8e43d7d68f77679c3601afa632dec9377b4 SHA-256: 10f2802bd456f5598d97bfedd050324df84d80497dcdc7d49cbb40f39001fe89

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The presence of an Auto_Open macro and a reference to CreateProcess API indicate malicious intent. The VBA script constructs a URL 'https://www.bitly.com/eyuiwqohdnasbmdansbdmhsa' which is likely used to download and execute a second-stage payload. The script's obfuscation and truncated nature prevent a more detailed analysis of its execution flow.

Heuristics 3

Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `65fbe56ba46a7306081bfc4a1e338f93777b8755466211c8ff6e7ee25f331bdf`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	5684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.