Win.Trojan.Laroux-44 — Office (OLE) malware analysis

Static analysis result for SHA-256 9e5a80261434d7fd…

MALICIOUS

Office (OLE)

29.0 KB Created: 1980-01-05 18:46:01 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: ecbdf9b89c74d3e14848c90793c70e40 SHA-1: 222e10ee0e6e12dfef3d436704e25118fb672626 SHA-256: 9e5a80261434d7fd9bddfb6a6d8a4c4f1a778f1860489a9a1d046cc12554b5aa
120 Risk Score

Malware Insights

Win.Trojan.Laroux-44 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as a malicious Excel 5 macro virus, specifically the Laroux family, based on critical heuristic firings. These firings indicate the presence of known macro virus markers such as 'laroux', 'auto_open', and 'OnSheetActivate'. The file's purpose is to execute malicious code through these macros.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-44 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-44
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.