MALICIOUS
200
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The sample is a PowerPoint document containing an embedded OLE object. This object is identified as an 'Ole10Native package' that drops an executable file named 'Powerpoint.scr'. ClamAV detections on both the main file and the extracted artifact confirm its malicious nature, likely as a downloader or dropper for further malware.
Heuristics 3
-
ClamAV: Win.Malware.Vbkryjetor-6622845-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Malware.Vbkryjetor-6622845-0
-
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILEOLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
-
Embedded OLE object medium OOXML_OLE_OBJECTDocument contains an embedded OLE object
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
ooxml_oleobject_00.bin |
ooxml-ole-object | OOXML embedded OLE part: ppt/embeddings/oleObject1.bin | 506368 bytes |
SHA-256: fb0ab5d7c01e9fd18307dc0ca08bf1a68503abc21c47b3d8047e6f0028e48177 |
|||
|
Detection
ClamAV:
Win.Malware.Vbkryjetor-6622845-0
Obfuscation or payload:
unlikely
|
|||
ooxml_oleobject_00_ole10native_00.bin |
ole-package | OOXML ppt/embeddings/oleObject1.bin Ole10Native stream: Ole10Native | 500081 bytes |
SHA-256: 248755b8fce275ea005a5c137afbd29fcb9a5c23e324551fa2c0074e936273d2 |
|||
|
Detection
ClamAV:
Win.Malware.Vbkryjetor-6622845-0
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.