Office (OLE) malware analysis — malicious · ffef8800db4e2a82

MALICIOUS

Office (OLE)

130.5 KB Created: 2008-09-25 03:54:49 Authoring application: Microsoft Office PowerPoint

MD5: e8f13851ec551b69b0d91b76451acdf5 SHA-1: 6c0ab9c7c2454f38cb6f24342ad29beb2bc1acec SHA-256: ffef8800db4e2a82de2731b4db3b57cb26d4b1b2120b8b59dedf6f54d05f24db

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with multiple signatures, including Ppt.Malware.Laroux-10036124-0 and Xls.Trojan.Escape-1 on an extracted artifact. Static analysis detected VBA macros, specifically an Auto_Open macro, indicating that the document is designed to execute malicious code upon opening. The document body content appears to be a standard operating procedure for returns, likely serving as a lure to disguise the malicious nature of the file.

Heuristics 4

ClamAV: Ppt.Malware.Laroux-10036124-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Ppt.Malware.Laroux-10036124-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `867f33b96943bbf9af8322b042228c20f1c738891f13586281fda186d6903141`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2056 bytes
Detection ClamAV: Xls.Trojan.Escape-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.