MALICIOUS
140
Risk Score
Malware Insights
The file is a malicious OLE document containing a NOP sled and XOR-encoded strings, indicating obfuscated malicious content. The document body suggests a lure to disguise the malicious nature of the file. While no specific exploit or payload is directly identified, the presence of these indicators strongly suggests an attempt to deliver malware.
Heuristics 3
-
XOR-encoded strings (key 0x95) critical SC_XOR_ENCODEDFound 8 Windows library/API name(s) XOR-encoded with single-byte key 0x95: 'kernel32.dll', 'kernel32.dll', 'iphlpapi.dll', 'GetProcAddress', 'GetProcAddress', 'VirtualAlloc', 'CreateProcessW', 'RegOpenKeyExW'
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 70,656 bytes but its declared streams total only 16,486 bytes — 54,170 bytes (77%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.