MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The sample exhibits characteristics of a malicious document, including XOR-encoded strings and embedded URLs, suggesting an attempt to download and execute a secondary payload. The OLE slack anomaly and the inability to extract VBA macros indicate a potentially obfuscated or malformed document structure. The presence of embedded URLs is a primary indicator of a delivery mechanism for further malicious content.
Heuristics 3
-
XOR-encoded strings (key 0x92) critical SC_XOR_ENCODEDFound 2 Windows library/API name(s) XOR-encoded with single-byte key 0x92: 'advapi32.dll', 'shell32.dll'
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 541,993 bytes but its declared streams total only 0 bytes — 541,993 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTEDolevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
Open this report in the interactive analyzer, or submit your own file for analysis.