MALICIOUS
122
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The sample is an OLE document with a high degree of slack space and an appended payload, indicating the presence of malicious content. Heuristics indicate the use of CreateProcess API, suggesting an attempt to launch an external process. The embedded URL, though benign, is present, and the document body is heavily obfuscated, further supporting the malicious nature. The presence of appended executable-looking bytes and the CreateProcess API firing strongly suggest the document is designed to drop and execute a secondary payload.
Heuristics 4
-
Reference to CreateProcess API high SC_STR_CREATEPROCESSReference to CreateProcess API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 122,272 bytes but its declared streams total only 20,632 bytes — 101,640 bytes (83%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOADOLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main
Open this report in the interactive analyzer, or submit your own file for analysis.