MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The file is an OLE document with a significant amount of slack space, which is a common technique for hiding malicious content. ClamAV detected it as Win.Trojan.W-283. The document body appears to be a list of students, likely a lure to encourage opening the file.
Heuristics 2
-
ClamAV: Win.Trojan.W-283 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.W-283
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 53,760 bytes but its declared streams total only 31,428 bytes — 22,332 bytes (42%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.