Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 2a79d33c995d56a6…

MALICIOUS

Office (OLE) / .PPT

1.46 MB Created: 2005-01-13 09:52:25 Authoring application: Microsoft PowerPoint
MD5: ab51a79a55a350c1d0213fc990db66f7 SHA-1: 1939541f717c4bab632354a9d32b916378ee71a8 SHA-256: 2a79d33c995d56a6baa3c2d2596249a2f272771c5383e5bcc5339febab28d24d
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1218 Signed Binary Proxy Execution T1059 Command and Scripting Interpreter T1059.003 Windows Command Shell

The sample exhibits high-confidence heuristic firings for CreateProcess, cmd.exe invocation, LoadLibrary, and GetProcAddress, indicating an attempt to execute external code. The presence of multiple unknown-reputation URLs suggests a potential distribution or command-and-control vector. Although no scripts were explicitly extracted, the combination of API calls and embedded URLs strongly suggests the document is designed to download and execute a second-stage payload.

Heuristics 6

  • ClamAV: Win.Trojan.Agent-40906 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-40906
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.virtuallandmedia.com
    • http://www.webutilities.com
    • http://hjem.wanadoo.dk/~wan30952
    • http://www.mindworkshop.com
    • http://www.ulead.com
    • http://dreamartists.com/animated.htm
    • http://www.mindworkshop.com�

Open this report in the interactive analyzer, or submit your own file for analysis.