MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The file is identified as malicious due to high-severity heuristics indicating malformed OLE structures and a large slack space anomaly. These indicators suggest the document may be intentionally crafted to evade detection or exploit parsing vulnerabilities. No specific attack pattern or malware family can be confidently determined from the available evidence.
Heuristics 2
-
x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EDI)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 101,759 bytes but its declared streams total only 8,934 bytes — 92,825 bytes (91%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.