MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File: User Execution
The sample is a Microsoft Word document exhibiting an OLE slack anomaly and contains XOR-encoded strings, indicating obfuscation. The presence of these indicators suggests an attempt to exploit a vulnerability within the document itself, likely leading to arbitrary code execution upon opening. No specific malware family could be identified, and no scripts were extracted for further analysis.
Heuristics 2
-
XOR-encoded strings (key 0x92) critical SC_XOR_ENCODEDFound 2 Windows library/API name(s) XOR-encoded with single-byte key 0x92: 'advapi32.dll', 'shell32.dll'
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 55,296 bytes but its declared streams total only 23,704 bytes — 31,592 bytes (57%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.