OK Folks here it is:

One of those silly inter-office, inter-company funnies.

1. It is a .pps (power point screen show) file of 111Kb.....SINGLE EXTENSION!.........the first thing one looks for? (.pps_.exe is CERTAINLY a bad guy, and sometimes they put a load of spaces in between so the last , executable extension is hidden) In this context you MUST set your preferences to show ALL file extensions. The default is to hide known file extensions.

2. There are no added/embedded macros.

3. Converted it to a .txt file and took it to a 9x box and used file manager (a 16 bit DOS app) to look at it in Wordpad (never use Word or Write, they can certainly launch executables) There would be no point in attempting to decompile it, as stuff out of MS office remains incomprehensible anyways. I have developed the skill of pattern recognition, and, to me, embedded code stands out like a sore thumb.

4. Launch it!............OK the first slide appears...............yes there are numbers on it (the title of the thing was "numbers"). Skip to the last slide...........if there is a trigger it will not be on the first, when people are still a bit wary, and not on the last, because the malware would run on after the end?

AH! it is a picture of a young lady, parts of whose anatomy is concealed by these "number" tags.................as you go through the show, they get removed..I can read enough "raw" Powerpoint to figure that out. She seems to have a rather nice "personality" or two?

So a few seconds research shows that it was produced by some guy working in the accounts department of a Brazilian Financial Institution (blackmail..........moi? )

I know his name, I know his employers, I can prove that he used their copy of MS office, and I know that he knows jack S**t about metadata.

Now, how did our colleague get it?.........from a friend, even though he does not know the sender, he said. He is not lying, the guy obviously created a sub-account under a false name..........he will be dealt with

Anyways, it turned out to be a false alarm of sorts............not that I believe in false alarms, I believe that anything suspicious should be verified first. Users will go with that......someone has sent them something, they WILL NOT delete it......but they will send it to be verified, I am afraid that is human nature.

Cheers