Win.Trojan.Laroux-72 — Office (OLE) malware analysis

Static analysis result for SHA-256 5a08e0b5c5388119…

MALICIOUS

Office (OLE)

144.0 KB Created: 1999-09-15 03:07:54 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 78ed1b490ac72a103c430e0bd301e6c2 SHA-1: e4114da092feb5bf23d842920b6b6b2389c15ba2 SHA-256: 5a08e0b5c5388119b905cde809529e862c5590e2a96326e39642ee6745da368d
120 Risk Score

Malware Insights

Win.Trojan.Laroux-72 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a malicious Excel 5 macro virus, specifically Win.Trojan.Laroux-72. The presence of 'laroux' markers and auto-execution functions within the OLE structure strongly indicates a macro-based attack. The primary function of this malware is to execute arbitrary code via its embedded VBA macros.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-72 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-72
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.