Win.Trojan.Laroux-55 — Office (OLE) malware analysis

Static analysis result for SHA-256 a01fb21a55b52dbb…

MALICIOUS

Office (OLE)

52.0 KB Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: dcf5f2d4777c2163459ac27f6d464bb6 SHA-1: f6a6d91b9ba01d8b5d128934a2db9b9de78ade7d SHA-256: a01fb21a55b52dbb9c35ee0784acf6a7eb946633925e7d5672a763ab9cb4decf
120 Risk Score

Malware Insights

Win.Trojan.Laroux-55 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as a malicious Excel 5 macro-virus, specifically Win.Trojan.Laroux-55. The presence of macro markers like 'auto_open' and 'OnSheetActivate' strongly indicates that the embedded VBA code is designed to execute automatically upon opening the document. This macro likely serves as a downloader for additional malicious content.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-55 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-55
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.