Win.Trojan.Laroux-59 — Office (OLE) malware analysis

Static analysis result for SHA-256 9ff3b65b6c5cd3fa…

MALICIOUS

Office (OLE)

22.5 KB Created: 1999-09-08 05:49:21 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 40d0aed33eb3dce4d7a64c4191a9daae SHA-1: c2ec865ee729b7a96d293e13270c9ef23f7dd0de SHA-256: 9ff3b65b6c5cd3fa7829353528681fd6c0d6c4550b05faea6e8e644668efb612
120 Risk Score

Malware Insights

Win.Trojan.Laroux-59 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a malicious Excel 5 macro virus, specifically the Laroux family (Win.Trojan.Laroux-59). Heuristic analysis indicates the presence of typical macro virus markers like 'auto_open' and 'OnSheetActivate', suggesting it executes malicious code when the document is opened or interacted with. The presence of the 'laroux' marker strongly points to this specific, older malware family.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-59 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-59
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.