Office (OLE) / .PPT malware analysis — malicious · 9ab06dad5958032d

MALICIOUS

Office (OLE) / .PPT

211.5 KB Created: 2021-07-06 22:31:40 Authoring application: Microsoft Office PowerPoint

MD5: 1b744789533dee1e231fd8d997e997eb SHA-1: f577719e9b25aa48f92d2cef8a0c22390b96dc86 SHA-256: 9ab06dad5958032d92be8b54abfd84e4a7828df3accffca30a459ad3a87ff4ec

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell

The file is a PowerPoint presentation containing a malicious VBA macro. The `auto_open` macro is triggered upon opening the file, and it uses `GetObject` to execute a payload. The script appears to be obfuscated, but the primary intent is to run an executable payload. No specific family could be identified.

Heuristics 4

Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `504eeb72be6ef9714408899a48832a7f795c55308bbe390fc65ef831b710ded4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	49046 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.