MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1059.001 PowerShell
The sample is an OLE document with a large slack space anomaly, indicative of obfuscation. A heuristic firing for PEB access suggests potential exploitation. The document body contains VBA-like code that attempts to write to the registry key HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems\{3C4D25E0-E689-4194-987B-000000000000}, likely to disable security features or establish persistence. The embedded URL is benign, but the overall structure and heuristics point to a malicious document designed to exploit a vulnerability and download a secondary payload.
Heuristics 3
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 103,424 bytes but its declared streams total only 16,486 bytes — 86,938 bytes (84%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main
Open this report in the interactive analyzer, or submit your own file for analysis.