Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 361879d9eb1fdfea…

MALICIOUS

Office (OLE) / .PPT

76.0 KB Created: 2006-08-16 00:00:00 Authoring application: Microsoft Office PowerPoint
MD5: 0b278b51a383b4d668068163cbef04b4 SHA-1: 132e659d5083117c9393de6a7501fc62f9d261c8 SHA-256: 361879d9eb1fdfea84499253a1213ce4cd2e4a76cb0bbd2275c10027bd7ad5a3
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1218.005 System Binary Proxy Execution: Mshta

The sample is a PowerPoint file containing VBA macros. The Auto_Close macro utilizes a Shell() call, which is flagged as critical. This macro likely executes a command via mshta.exe, as indicated by the SC_STR_MSHTA heuristic. The embedded URL, while marked as confirmed benign, is present in the document text and could have been used for payload delivery. The VBA p-code auto-execution with execution tokens further supports the malicious intent.

Heuristics 6

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Reference to mshta.exe high SC_STR_MSHTA
    Reference to mshta.exe
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://%6786d78asd6786d78asd%6786d78asd%6786d78asd@j.mp/dwfwmdwwdkww

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
31fdbc45527d0d71e0385789c5c81776dfef8143b24a3c5e3b90fae2d80ae542		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 478 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.