Office (OLE) / .PPT malware analysis — malicious · 4e359fd4c6593422

MALICIOUS

Office (OLE) / .PPT

61.5 KB Created: 2020-05-15 00:34:21 Authoring application: Microsoft Office PowerPoint

MD5: 1540da7ebf4fa2bdebd9921b70ff5db7 SHA-1: 46f164787aff46f6bb8a1faf9d0331c92a178b6a SHA-256: 4e359fd4c6593422398344a7a725630865ab0fc9f43ea9187aeb9e03f8f8d07e

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1218.005 Mshta

The critical OLE_VBA_SHELL heuristic firing, combined with the OLE_VBA_AUTOCLOSE and OLE_VBA_PCODE_AUTOEXEC_EXEC firings, indicates that the Auto_Close VBA macro is designed to execute a command. The SC_STR_MSHTA heuristic further suggests that mshta.exe is invoked, a common technique for downloading and executing malicious content. No specific URLs or hashes were extracted, limiting further analysis.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Reference to mshta.exe high SC_STR_MSHTA

Reference to mshta.exe
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5ebb3fab5c2ef3122ec6691d88c731ee8ae6c9c65d19b2362f42ef21659cab62`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	469 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.