Malicious Office (OLE) / .PPT — malware analysis report

Static analysis result for SHA-256 ce83bf1b3621dba0…

MALICIOUS

Office (OLE) / .PPT

659.0 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft PowerPoint
MD5: f26c6c30b46b356f83d93835716921a1 SHA-1: 97003c8fcec75aac6cfcf7065e33ed88daf4c9c3 SHA-256: ce83bf1b3621dba01aceb800bc490b7e1141123141ff9a50149fd301433ae104
562 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.003 Windows Command Shell T1055.012 Process Hollowing T1105 Ingress Tool Transfer

The sample is a PowerPoint file containing an embedded PE executable, identified by ClamAV as Win.Trojan.Inject-46. Critical heuristics indicate the use of WriteProcessMemory and CreateRemoteThread, strongly suggesting process injection. The embedded executable is the primary indicator of malicious intent, likely serving as a loader for further malicious activity.

Heuristics 15

  • Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
    Reference to WriteProcessMemory API
  • Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD
    Reference to CreateRemoteThread API
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Win.Trojan.Inject-46 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Inject-46
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED
    Long run of 0x61 bytes
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/photoshop/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#
    • http://ns.adobe.com/tiff/1.0/
    • http://ns.adobe.com/exif/1.0/
    • http://www.mercycorps.org/chinaearthquake

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_office_00003e87.exe
977c56d90cfd201d42edacedeffa033da1b96b3ce65bf7151104fc30e77e44b1		 embedded-pe Office MZ+PE at offset 0x3E87 658809 bytes
Detection
ClamAV: Win.Trojan.Inject-46
Obfuscation or payload: likely
Carved artifact entropy is 7.68, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.