Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 54ebe9f5cb29918f…

MALICIOUS

Office (OLE) / .PPT

70.0 KB Created: 2006-08-16 00:00:00 Authoring application: Microsoft Office PowerPoint
MD5: fd9266a2e0f33ee4c26824cdf2743bfc SHA-1: dcf0dec4c4a315c32473ca5bf7a14bcb1f2798c5 SHA-256: 54ebe9f5cb29918f9572021689eb4161b55b788ebde9699de1cf74bb2c544fd9
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell

This Office document contains VBA macros, specifically an Auto_Close macro that utilizes the Shell() function. This indicates the macro is designed to execute arbitrary commands upon closing the document. The presence of the Shell() call and the Auto_Close trigger strongly suggests a malicious intent to run an external payload. No specific family could be identified, but the technique is common for initial execution.

Heuristics 4

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
3710cd28ccd2507e10c3a08c58f75749dffa21fa022884c0d4b1f31d84096231		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 293 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.