MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The sample is a Microsoft Word document exhibiting OLE slack anomalies, indicating potential obfuscation or embedded malicious content. Heuristics indicate the presence of LoadLibrary and GetProcAddress API calls, commonly used by malware to load and execute code. The document body contains heavily garbled text, suggesting it is not intended for direct user interaction but rather to trigger an exploit or load a secondary payload. The combination of these factors points to a malicious document designed to download and execute further stages.
Heuristics 3
-
Reference to LoadLibrary API high SC_STR_LOADLIBRARYReference to LoadLibrary API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 189,440 bytes but its declared streams total only 94,801 bytes — 94,639 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.