Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 85744d0fc79b2ebc…

MALICIOUS

Office (OLE) / .PPT

62.0 KB Created: 2020-05-12 22:55:13 Authoring application: Microsoft Office PowerPoint
MD5: c04cfe50eeb2748a0b00897c46518715 SHA-1: 22a699fd1ba4875f491981359bc00982a2b790ee SHA-256: 85744d0fc79b2ebc00288e666c433ed04417b1036b2d4bc89559eda3bd6e8f50
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is a PowerPoint file containing VBA macros. The critical heuristic firing for Shell() call in VBA, combined with the Auto_Close macro and VBA p-code auto-exec with execution tokens, indicates that the macro is designed to execute arbitrary commands upon opening or closing the presentation. The presence of CreateObject and Shell() calls strongly suggests the macro attempts to download and execute a secondary payload. No specific family could be identified from the available evidence.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
987daf16e539e461f132f8927f34b98446214bf6e2bcec78ccc0591e62c49d84		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 897 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.