MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious File
T1059 Command and Scripting Interpreter
The sample exhibits a large amount of slack space within the OLE structure, a common characteristic of packed or obfuscated malicious documents. Additionally, it triggers a heuristic for PEB access, suggesting attempts to manipulate process information, often used to evade detection or facilitate further execution. The document body contains heavily obfuscated and unreadable text, indicating a likely attempt to conceal malicious intent, possibly involving a downloader or exploit.
Heuristics 2
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 160,272 bytes but its declared streams total only 17,055 bytes — 143,217 bytes (89%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.