Winspy — Office (OLE) / .PPT malware analysis

Static analysis result for SHA-256 cc379eec16bbcece…

MALICIOUS

Office (OLE) / .PPT

402.0 KB Created: 2010-07-10 04:16:44 Authoring application: Microsoft Office PowerPoint
MD5: f23330c7e0eb14d3ecde92a49b7b52a4 SHA-1: 8e501dfa40d8c648341c7c50b9bfca2df6eb7f03 SHA-256: cc379eec16bbcece42e2387fd0e564be017afba3a7d982cfd3fb80c23c96b3e0
60 Risk Score

Malware Insights

Winspy · confidence 75%

MITRE ATT&CK
T1059.001 PowerShell

The file is identified as malicious by ClamAV with the signature Win.Spyware.Winspy-9772503-0, indicating it is likely spyware. The PowerPoint file itself contains minimal user-facing content, suggesting its primary purpose is to host malicious content rather than engage the user with a lure. No scripts or further IOCs were extracted, limiting the analysis of its specific delivery mechanism.

Heuristics 1

  • ClamAV: Win.Spyware.Winspy-9772503-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Spyware.Winspy-9772503-0