Office (OLE) / .PPT malware analysis — malicious · 212b24f28064706d

MALICIOUS

Office (OLE) / .PPT

67.0 KB Created: 2022-06-20 21:46:45 Authoring application: Microsoft Office PowerPoint

MD5: f95997472db60afdcf2d3077ea95d389 SHA-1: 6d914d97b99e2afd23aab6b5af4d43d8cf9f62a4 SHA-256: 212b24f28064706d746da8e31914fc9c400ff2a0d4087dd9a40b7a915d05db8f

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1218.005 Mshta

The presence of a VBA Auto_Close macro that executes mshta.exe indicates a malicious intent to download and run a secondary payload. The macro's p-code indicates execution tokens, further supporting this. The embedded URL, although marked as confirmed benign, is still included as a potential IOC. The specific family could not be determined due to the generic nature of the macro.

Heuristics 5

Reference to mshta.exe high SC_STR_MSHTA

Reference to mshta.exe
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://bitbucket.org/!api/2.0/snippets/rikimartinplace/kq7y7E/aa4f0798445caf750700947d43530e82849f0dd9/files/blackfinal1

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `1d98165d2ce519f3d8c456fc9792f2177ad3818accc333b2e1c1cfea8eb73cfd`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1086 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.