Office (OLE) / .PPT malware analysis — malicious · 54670ce1c29d6769

MALICIOUS

Office (OLE) / .PPT

240.0 KB Created: 2006-08-16 00:00:00 Authoring application: Microsoft Office PowerPoint

MD5: 3e62fc9944a9a780fe77e4f3cdbc5b7c SHA-1: e70654becfa238e70c8cb85bdea93d2c1dec97a1 SHA-256: 54670ce1c29d6769066d555d5ccb57bf1163b5573e393dcd968cd22ac7b114f1

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell

The sample is a PowerPoint presentation containing VBA macros. The Auto_Close macro is configured to execute a command using the Shell() function. This indicates the macro is designed to run arbitrary commands upon closing the presentation. No specific malware family could be identified, but the technique is common for initial execution of malicious payloads.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://1230948%1230948@j.mp/jaslpjidkokplsaplaslpasplaslspajj

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `2821e33f8eed61bc9da36c97667a2fc3f9901ce14eee9d12bd4fa400f1be9d33`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	21339 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.