Office (OLE) / .PPT malware analysis — malicious · a7399ec8e03b6565

MALICIOUS

Office (OLE) / .PPT

100.0 KB Created: 2020-11-25 12:27:07 Authoring application: Microsoft Office PowerPoint

MD5: e258cf4842a6931de0bca2f013b98c26 SHA-1: fd728a09c87a015be178d2c962e2f6517618ed88 SHA-256: a7399ec8e03b65651815294eaedf936b1ad7d2c7b07805c5afbd11774ab59e31

280 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file contains VBA macros, specifically an Auto_Close macro, which is designed to execute automatically. Critical heuristics indicate the use of a character-shift decoder to obfuscate a Shell() command. This strongly suggests the macro's purpose is to download and execute a second-stage payload. The ClamAV detection name 'Doc.Malware.Valyria-10008087-0' further supports its malicious nature.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
VBA character-shift decoded Shell command critical OLE_VBA_ASC_CHR_SHIFT_SHELL

VBA auto-exec macro stores an encoded command string, decodes it with a Mid/Asc/Chr character-shift loop, and passes the recovered text to Shell. This is a high-confidence command stager.
ClamAV: Doc.Malware.Valyria-10008087-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Valyria-10008087-0
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `c326a234019479349d0d7b5fcf6cfa5bb9b2a0bb7bf2c8cad1d5a31cf633003e`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4453 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.