Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 2cc3dbf0d10af63f…

MALICIOUS

Office (OLE) / .PPT

55.5 KB Created: 2020-03-23 13:42:46 Authoring application: Microsoft Office PowerPoint
MD5: e23c060d79410ab3ac513cadd0281d4b SHA-1: 5d6bc851c9173148b3dbaf8f3e495b5e59d4bcc6 SHA-256: 2cc3dbf0d10af63f7edd8b0c906af32063285f6b5bdfc7d3353ea22419248bbf
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file contains VBA macros, specifically an Auto_Close macro that utilizes the Shell() function. This indicates the macro is designed to execute an external command upon closing the presentation. The critical heuristic firing on Shell() call in VBA and the p-code auto-execution with execution tokens strongly suggest the intent is to download and execute a second-stage payload. No specific family could be identified from the available evidence.

Heuristics 4

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b48f9a90e4dab89e884105a5b2770100e34547727dfd4e4e2168af62c388752c		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 154 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.