MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment
T1566.002 Phishing:Spearphishing Link
The file is a malicious OLE document with a significant amount of slack space, suggesting obfuscation or embedded malicious content. Although VBA macros could not be extracted, the presence of an embedded URL indicates a phishing or malware delivery attempt. The XOR-encoded strings further suggest malicious intent, likely to hide malicious code or URLs.
Heuristics 3
-
XOR-encoded strings (key 0xA4) critical SC_XOR_ENCODEDFound 4 Windows library/API name(s) XOR-encoded with single-byte key 0xA4: 'LoadLibraryA', 'CreateProcessA', 'ExitProcess ', 'CreateFileA '
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 71,680 bytes but its declared streams total only 20,635 bytes — 51,045 bytes (71%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTEDolevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
Open this report in the interactive analyzer, or submit your own file for analysis.