Advice Request is this file malicious? [Update]

[Parkinsond]

cracked program??

The bat file is either the installer, or combined installer installer and activator; depends on its content shown in notepad.

 

[Parkinsond]

True, but coming from a Microsoft programme, it's rather odd.

I see Office either as an .EXE with the installation logo, or as an ISO

When you extract the official iso, you will get the exe.
Another official source is to download the data folder from MS directly using cmd.

 

[roger_m]

It's an Office 2024 installation file, but I have to admit that disguising it as an SFX file is a bit weird....

The .xml file is needed as it tells the setup.exe to download the LTSC version of Office. It the standard way that LTSC versions of Office are installed. With LTSC versions, you can't just go to setup.office.com and enter your product key.

<Configuration>
<Add OfficeClientEdition="64" Channel="PerpetualVL2024">
<Product ID="ProPlus2024Volume">
<Language ID="en-US"/>
</Product>
</Add>
</Configuration>

Deploy Office LTSC 2024 - Office

Provides IT admins with information on how to deploy Office LTSC 2024.

learn.microsoft.com

It's been packed as a SFX archive as you need all of the contained files to download and install LTSC versions of Office and not just setup.exe. It's how sites selling dodgy LTSC licenses usually provide a download of Office and I've used a similar, or perhaps even the same SFX file myself.

 

[fedor345]

It's an Office 2024 installation file, but I have to admit that disguising it as an SFX file is a bit weird....

Spoiler: SFX

View attachment 289030
View attachment 289031

Once extracted, a .BAT file will open the installation, reading an XML configuration file (cracked program??)

Spoiler: Decompilate

View attachment 289032
View attachment 289033

The file itself isn't malicious, but downloading the original .EXE to a Google Drive reminds me of a cracked version of Office.
I wouldn't install it on my home PC.

oh okay. is there really some serious threat that could harm my pc? or dont you have some alternative file which contains office and its safe to use?(you dont probably support cracks but im just asking)

 

[roger_m]

@fedor345 First, you need to know where it was downloaded from and whether the website is official Microsoft. Otherwise, I would be wary, even if VT considers it clean.

The SFX files contains the Office setup file from Microsoft and the batch and the standard configuration files that are used to deploy LTSC versions of Office. There's nothing suspicious about it. But I don't know why they are providing it this way, rather than just providing a link to download the img file.

 

[alexxjohn]

looks like malicious

 

[Parkinsond]

Microsoft usually offers the Office package in an image format similar to this Office 365 image, which is 3.5 GB in size

The official iso from MS is approx 5.1 GB, as it contains both 64 and 32 forms; but you can extract it to a folder, delete 32 components, and repack it into a new iso, which will be approx 2.6 GB.
In addtion, you can download 64 version directly from MS but not in iso format; its size will be also 2.6 GB or a little bit more.

The SFX files contains the Office setup file from Microsoft and the batch and the standard configuration files that are used to deploy LTSC versions of Office. There's nothing suspicious about it. But I don't know why they are providing it this way, rather than just providing a link to download the img file.

The answer is size.
SEP before extraction is 92 MB, after extraction is 228 MB.

 

[roger_m]

The answer is size.
SEP before extraction is 92 MB, after extraction is 228 MB.

But in this case the SFX file has an installer from Microsoft that downloads Office. It does not contain the img file.

 

[piquiteco]

The official iso from MS is approx 5.1 GB, as it contains both 64 and 32 forms; but you can extract it to a folder, delete 32 components, and repack it into a new iso, which will be approx 2.6 GB.
In addtion, you can download 64 version directly from MS but not in iso format; its size will be also 2.6 GB or a little bit more.

Yes, that's right, it's bigger, this image is certainly old, I downloaded it in 2020, and I never used it, I thought I had deleted it. There was already a 5GB image when I went to download it, but I gave up at the time.

 

[Parkinsond]

But in this case the SFX file has an installer from Microsoft that downloads Office. It does not contain the img file.

According to its contents; if it contains the data folder, you need no internet connection for insall.

Yes, that's right, it's bigger, this image is certainly old, I downloaded it in 2020, and I never used it, I thought I had deleted it. There was already a 5GB image when I went to download it, but I gave up at the time.

The newer the downloaded img file, the larger the size; included updates increase its size.
I rarely use Office, too. Notepad is sufficient for my day-to-day use; sometimes, when I feel bored, I install Office for fun

 

[roger_m]

According to its contents; if it contains the data folder, you need no internet connection for insall.

You do need an internet connection, as it only contains Microsoft's deployment tool, and a few config and batch files, rather than the full Office installation files.

@fedor345Microsoft usually offers the Office package in an image format similar to this Office 365 image, which is 3.5 GB in size.
[/SPOILER]

It seems that LTSC versions of Office can only be installed using Microsoft's deployment tool contained in the SFX file, rather than from the img file.

 

[piquiteco]

It seems that LTSC versions of Office can only be installed using Microsoft's deployment tool contained in the SFX file, rather than from the img file.

You're right, I'm sorry for the misunderstanding, I thought you had shown the .xml file to make a custom installation. @fedor345 follow @roger_m's guidelines he is correct in his information. I will remove my post #26 as it is irrelevant.

 

[Parkinsond]

It seems that LTSC versions of Office can only be installed using Microsoft's deployment tool contained in the SFX file, rather than from the img file

I can install LTSC version from img file; also, I can install retail version from LTSC download folder; they are interchangeable.

 

[piquiteco]

I can install LTSC version from img file; also, I can install retail version from LTSC download folder; they are interchangeable.

So does this mean that the Office LTSC version has the same long-term support as the Windows 10 and 11 LTSC versions?

 

[Parkinsond]

So does this mean that the Office LTSC version has the same long-term support as the Windows 10 and 11 LTSC versions?

You have three major versions.
MS 365 is the best; it is a subscription version with monthly fees, has no life-time key, and gets all the new features indefinitely.
Office retail; it is activated with a life-time key, and gets new featuers for a limited period (until end of support).
Office LTSC; it is activated by volume key, and does not get any new featuers, only security fixes.

 

[piquiteco]

Office LTSC; it is activated by volume key, and does not get any new featuers, only security fixes.

Okay, I get it. It's more or less like support for Windows LTSC versions.

 

[Parkinsond]

Okay, I get it. It's more or less like support for Windows LTSC versions.

Both Windows and Office share LTSC label because both will not receive any new features with updates, only security fixes.
The best combo is Windows 11 LTSC with security updates until Oct 2034 with MS 365 with new features and security updates forever.

 

[Trident]

The sandbox analysis reports no suspicious communications or behaviour. In addition, no engine detects malware.

 

[anirbandutta01]

Scanned the Hash with MetaDefender.


Hash scanning result

 

[Parkinsond]

Scanned the Hash with MetaDefender.

View attachment 289039
Hash scanning result

The two detections are by minor vendors; I think it is FP.