MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The file is an RTF document disguised as an OLE object, which is a common technique for delivering exploits. The large slack space and the object pool container disguised as RTF are strong indicators of malicious intent. No specific malware family could be identified, and no document body or scripts were extracted to provide further context on the payload.
Heuristics 2
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 210,141 bytes but its declared streams total only 94,801 bytes — 115,340 bytes (55%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
OLE ObjectPool in file named RTF high OLE_OBJECTPOOL_CONTAINER_DISGUISED_RTFFile is an OLE compound document named .rtf and contains ObjectPool embedded-object storage, suggesting a disguised Word/OLE container with embedded object attack surface.
Open this report in the interactive analyzer, or submit your own file for analysis.