Office (OLE) / .PPT malware analysis — malicious · c5f82ef31215233b

MALICIOUS

Office (OLE) / .PPT

2.32 MB Created: 2003-12-04 07:58:50 Authoring application: Microsoft Office PowerPoint

MD5: e80a36b1deed22f9a5451f8a72dd5355 SHA-1: f07535a38578cdf5c707c4e8b11c524eaba881e1 SHA-256: c5f82ef31215233ba518bbcec7763eb8066fbae9a6e866ac4d8247cf68db4853

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as a malicious PowerPoint presentation due to the presence of VBA macros, specifically an Auto_Open macro which is a common technique for initial execution. While the document body contains what appears to be a business report, the macro's presence indicates a malicious intent, likely to download and execute a secondary payload. No specific family could be identified, and no IOCs were extracted beyond the presence of the macro itself.

Heuristics 3

Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `326cdf2d8201f725ca848adb1a68eac2d6a05fde414d2bb4d9581012115deefa`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1878 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.