Win.Trojan.Laroux-12 — Office (OLE) malware analysis

Static analysis result for SHA-256 1885e10c931d35a7…

MALICIOUS

Office (OLE)

103.5 KB Created: 1980-01-04 21:11:16 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 866839c5a1c46d535315579ae6dbb4be SHA-1: 26123902eaa94daf19453752503de6b3842fef3c SHA-256: 1885e10c931d35a7a2a421f43c7207c237f25a21627576be6ec0f16784a8795e
120 Risk Score

Malware Insights

Win.Trojan.Laroux-12 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a malicious Excel 5 macro-virus, specifically Win.Trojan.Laroux-12. Heuristics indicate the presence of macro markers commonly associated with the Laroux family, including auto_open and various workbook/module manipulation functions. The document body contains garbled text, suggesting potential obfuscation or corruption, but the core functionality points to macro execution.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-58 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-58
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.