MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File Execution: Malicious File
T1059.001 Command and Scripting Interpreter: PowerShell
The file is identified as malicious by ClamAV with the signature Win.Exploit.Shellcode-23, indicating it contains shellcode. High severity heuristics for NOP sled and OLE slack anomaly further support the presence of injected or obfuscated code. The document body is heavily corrupted, preventing analysis of its specific lure, but the overall evidence points to a classic exploit document designed to drop and execute a secondary payload.
Heuristics 3
-
ClamAV: Win.Exploit.Shellcode-23 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Exploit.Shellcode-23
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 75,264 bytes but its declared streams total only 16,486 bytes — 58,778 bytes (78%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.