MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1027 Obfuscated Files or Information
The sample is an XLS file exhibiting high heuristic firings for PEB access and XOR-encoded strings, indicating obfuscation and potentially malicious code execution. The large slack space in the OLE structure is also anomalous. While no specific malicious scripts or URLs were extracted, the document body presents itself as a series of official application forms, a common lure for phishing or malware delivery. The XOR-encoded strings suggest the presence of hidden malicious functionality.
Heuristics 3
-
XOR-encoded strings (key 0x97) critical SC_XOR_ENCODEDFound 6 Windows library/API name(s) XOR-encoded with single-byte key 0x97: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'VirtualProtect', 'RegOpenKeyExA'
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 86,016 bytes but its declared streams total only 21,308 bytes — 64,708 bytes (75%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.