OLE document has large unaccounted-for region

OLE_SLACK_ANOMALY

← All detection heuristics · Office

info OLE_SLACK_ANOMALY

What it means

OLE file bytes greatly exceed the sum of declared stream sizes.

Why it fires

Well-formed Office binary documents pack data into named streams with little slack. When the file is dramatically larger than its declared streams (>40% slack and >16 KB of unaccounted bytes), the extra bytes live in unallocated sectors. Pre-macro-era Word/Excel exploits (e.g. CVE-2010-3333, CVE-2014-1761, CVE-2015-2424) commonly hide XOR-encoded shellcode in this region, reached via a parser pointer-corruption bug in the document structure. The finding is a structural triage signal, not malicious evidence on its own, and carries no verdict score.

Other Office heuristics

OLE_VBA_AFFINE_MSI_DOWNLOADER OLE_VBA_AUTOEXEC_FRAGMENTED_SHELL OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN OLE_VBA_BIDIRECTIONAL_MACROCOPY_REPLICATION OOXML_BRAND_LINK_MISMATCH_LURE CVE_2016_7262 POLYGLOT_OOXML_REL_COMMAND OLE_RAW_PCODE_CROSS_DOCUMENT_REPLICATION OLE_VBA_CROSS_WORKBOOK_REPLICATION OOXML_XLM_DANGEROUS_FN OFFICE_DEFAULT_PASSWORD_VBA_DROP_EXEC OFFICE_EMBEDDED_SWF EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE OFFICE_EMBEDDED_MACRO_OBJECT OLE_EMBEDDED_EXE OLE_VBA_EMBEDDED_PE_DROPPER OLE_ENCRYPTED_AND_MALFORMED CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED CVE_2017_11882 OLE_EQUATION_OLE10NATIVE_DOWNLOADER OLE_MTEF_NATIVE_CODE_STUB OLE_EQUATION_OLE10NATIVE_SHELLCODE OOXML_XLM_MACRO_IN_WORKSHEET OLE_XLS5_LAROUX_MACRO_VIRUS