MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The file is an OLE document with a significant amount of slack space, indicating potential obfuscation or embedded malicious content. The presence of a NOP sled further suggests an attempt to exploit a vulnerability. Although VBA macros could not be extracted, the overall structure and heuristic firings point towards a malicious document designed to deliver a secondary payload.
Heuristics 3
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 67,040 bytes but its declared streams total only 12,338 bytes — 54,702 bytes (82%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTEDolevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
Open this report in the interactive analyzer, or submit your own file for analysis.