Win.Trojan.Bifrose-19335 — Office (OLE) / .PPS malware analysis

Static analysis result for SHA-256 51bd84270ab82daa…

MALICIOUS

Office (OLE) / .PPS

404.0 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft PowerPoint
MD5: f3393ba7bbe165cd5e406c55c775c890 SHA-1: 3cadefcf555fd96d3006b31dfc4b0415dac94551 SHA-256: 51bd84270ab82daa36eef99e5bc07d56da1ca0eb76cee0709b6434fa019b28a7
340 Risk Score

Malware Insights

Win.Trojan.Bifrose-19335 · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a PowerPoint file (PPS) identified by ClamAV as Win.Trojan.Bifrose-19335. It contains an embedded PE executable, indicating a likely delivery mechanism for a secondary malicious payload. The heuristics for PEB access and API hash resolution suggest anti-analysis techniques commonly employed by trojans.

Heuristics 7

  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Win.Trojan.Bifrose-19335 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Bifrose-19335
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00003678.exe
b308fc55e8d3d085fe5a8f8584de6952038ab45d94c7ccac2d85e06a046cc4d1		 embedded-pe Office MZ+PE at offset 0x3678 399752 bytes
Detection
ClamAV: Win.Trojan.Bifrose-19335
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.