Win.Dropper.Agent-30181 Office (OLE) / .PPS malware analysis — malicious · e22805d4f845c42d

MALICIOUS

Office (OLE) / .PPS

818.5 KB

MD5: a362abe459c574b1984640316219c818 SHA-1: cae75ae5cb63e13b1d603a4088983278da1696ff SHA-256: e22805d4f845c42d801e6b2b87782716a01c2db0553e2b4da7eda355ba28cdcf

240 Risk Score

Malware Insights

Win.Dropper.Agent-30181 · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is a PPS slideshow containing VBA macros, specifically an AutoOpen macro, which is a common delivery mechanism for malware. The ClamAV detection of 'Win.Dropper.Agent-30181' strongly suggests its purpose is to download and execute a secondary payload. The presence of PEB access heuristics further indicates malicious activity. The document body is heavily obfuscated and unreadable, providing no direct clues to the lure.

Heuristics 6

ClamAV: Win.Dropper.Agent-30181 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Dropper.Agent-30181
PEB access via FS segment (x86) high SC_PEB_ACCESS

PEB access via FS segment (x86)
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7403e4728955600b20e1b11715dae9328df16f95bc7db40bf64d8dfe55835d1d`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1005 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.