Win.Trojan.Laroux-69 — Office (OLE) malware analysis

Static analysis result for SHA-256 b26d9960fc327f34…

MALICIOUS

Office (OLE)

83.0 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 87423cee2f19268aa8d6458de49896d4 SHA-1: b079fb4f68b57b9516f73b4d99e04f4e1568ede3 SHA-256: b26d9960fc327f34f429dc715473864af4ab566fd3d1d768d5a4a4a2c23701a0
120 Risk Score

Malware Insights

Win.Trojan.Laroux-69 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a malicious Excel 5 macro-virus, specifically Win.Trojan.Laroux-69. The presence of 'laroux' and 'auto_open' markers strongly indicates a macro-based execution. The document body contains garbled text, suggesting it's not intended for user interaction but rather to host the malicious macro.

Heuristics 2

  • ClamAV: Win.Trojan.Laroux-69 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Laroux-69
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.

Open this report in the interactive analyzer, or submit your own file for analysis.