Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 59d64ce96a67edd3…

MALICIOUS

Office (OLE) / .PPT

225.0 KB Created: 2006-08-16 00:00:00 Authoring application: Microsoft Office PowerPoint
MD5: fc0d5525d36deaecd1cfa1ea04e59bbc SHA-1: 687600b6adaa59c5deb25920675a6d5f1e3cd157 SHA-256: 59d64ce96a67edd30abc7d2124e91529098d7e9de00b3343b638e94f9e556e28
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell

The file is a PowerPoint presentation containing VBA macros. A high-severity heuristic indicates that the VBA p-code executes auto-close functions using Shell, which is a strong indicator of malicious intent. The macros are likely designed to download and execute a secondary payload, although no specific URLs or commands were extracted from the provided evidence. The presence of VBA macros and the auto-close execution pattern suggest a downloader or droppper functionality.

Heuristics 2

  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
85aad2dd264ccec55f219b32ac28888616fa724e522eb7f380dabe099b83e558		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 10131 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.