MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The file is identified as malicious by ClamAV with the signature Win.Trojan.Cap-1. Static analysis revealed a large slack space anomaly within the OLE structure, often indicative of packed or obfuscated malicious code. The document body content appears to be technical text related to numerical methods, which may serve as a lure to distract from the malicious payload.
Heuristics 2
-
ClamAV: Win.Trojan.Cap-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.Cap-1
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 166,400 bytes but its declared streams total only 73,871 bytes — 92,529 bytes (56%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.