Office (OLE) / .PPT malware analysis — malicious · 317535c475111454

MALICIOUS

Office (OLE) / .PPT

251.0 KB Created: 2020-11-01 23:20:18 Authoring application: Microsoft Office PowerPoint

MD5: b13e42c9383c05c684f85c58e96b12e3 SHA-1: 3731b32b7965d7fb3353269d6bbc0261932136bd SHA-256: 317535c475111454c5a8964df8ea26c9cf807b19adecf18b37b0fb6aa12ff846

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is a PowerPoint presentation containing VBA macros. The critical heuristic 'OLE_VBA_SHELL' indicates the use of the Shell() function, and the 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic confirms this is triggered by an Auto_Close macro. This suggests the macro is designed to execute arbitrary commands, likely to download and run a secondary malicious payload. No specific family could be identified.

Heuristics 4

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5bfc7b2089de77a9ab4b1c82da908ab14c2f3de7a71e18a38cbe94dc0469ea50`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	259506 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.