Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 a1efe2f0bd247eb5…

MALICIOUS

Office (OLE) / .PPT

64.0 KB Created: 2021-02-27 07:31:42 Authoring application: Microsoft Office PowerPoint
MD5: 8d58929f5c60c78a6130843847116f1a SHA-1: 745d17d5083bd90f8e5d56583ed02599339216d9 SHA-256: a1efe2f0bd247eb5049df01660eef416c7c6bc083d92e0f1a2b0661fffa3fd81
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell

The file is a PowerPoint presentation containing VBA macros. The critical heuristic firing indicates the use of the Shell() function within a VBA macro, specifically within an Auto_Close routine. This suggests the macro is designed to execute arbitrary commands upon closing the presentation, likely to download and execute a secondary payload. No specific family could be identified, and no external IOCs were extracted.

Heuristics 4

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a2536e3eb7f912e07cfbd1c63e572e956f667d9a18a7b7dbf6ac164fdf3da0f3		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 3097 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.