MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The sample is a malicious OLE document with a significant amount of slack space, indicating potential obfuscation or embedded malicious content. The presence of an x86 GetPC stub heuristic firing suggests the exploitation of a code execution vulnerability within the document. Without further script or body content, the exact exploit and payload remain undetermined, but the overall pattern points to a classic Office exploit document.
Heuristics 2
-
x86 GetPC stub (CALL $+5; POP EDI) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EDI)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 95,615 bytes but its declared streams total only 16,543 bytes — 79,072 bytes (83%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.