Office (OLE) / .PPT malware analysis — malicious · c0fc8709ad9fd887

MALICIOUS

Office (OLE) / .PPT

68.0 KB Created: 2021-05-17 20:49:49 Authoring application: Microsoft Office PowerPoint

MD5: ae6b5705e205ff7dd2d6753cd7b7a09b SHA-1: 671e5e330ddda751cbd424eec590bfd7e4d3150d SHA-256: c0fc8709ad9fd88782c0cb1bc64e014dea95fee48dcbe81dfe61f25661bc6fbf

182 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1218.005 System Binary Proxy Execution: Mshta

The sample contains VBA macros, specifically an Auto_Close macro, which is designed to execute code upon closing the presentation. The heuristic firings indicate the use of mshta.exe and an embedded URL, suggesting the macro's purpose is to download and execute a second-stage payload. The Auto_Close macro is configured to execute 'Shell' commands, further supporting this. The embedded URL was confirmed as benign, but the overall pattern is indicative of a downloader.

Heuristics 6

Reference to mshta.exe high SC_STR_MSHTA

Reference to mshta.exe
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.

URL http://www.j.mp/jkdlasjdklasjdlakjdkalfg

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5b1cee6d438d160c1ccd5919d7e8bc5f0a47fb15d569710ca72400e3913741f7`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1273 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.