MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1027 Obfuscated Files or Information
The document contains a NOP sled, indicating potential shellcode execution. The presence of an EMF object within an EPRINT stream is also suspicious. While the document body discusses technical integration requirements, the underlying structure suggests an attempt to hide malicious code. No scripts were extracted from this sample.
Heuristics 3
-
Office EPRINT stream contains EMF object high OLE_EPRINT_EMF_OBJECTOLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLEDLong run of 0x41 bytes
Open this report in the interactive analyzer, or submit your own file for analysis.