Win.Trojan.Laroux-46 — Office (OLE) malware analysis

Static analysis result for SHA-256 228bdda9845f301a…

MALICIOUS

Office (OLE)

17.5 KB Created: 1998-09-23 02:11:45 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 335c21cfd89e5652ee8256698e60ff77 SHA-1: 2da83079665f5c536c19d4dad93c9e5f802ca986 SHA-256: 228bdda9845f301a5f92e2364d3e5d3d5a958f988a5fb04770e7d16c59ac54a8
120 Risk Score

Malware Insights

Win.Trojan.Laroux-46 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as an Excel 5 macro-virus, specifically the Laroux-CV variant, based on critical heuristic firings. The presence of markers like 'laroux', 'auto_open', and 'PERSONAL.XLS' strongly indicates its malicious nature. The document body contains garbled text, suggesting it is not intended for user interaction but rather to host the malicious macro.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-46 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-46
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.