MALICIOUS
200
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The sample is a malicious OLE document exhibiting a large slack space anomaly and containing an EMF object within its EPRINT stream. Heuristics indicate the presence of a NOP sled and calls to LoadLibrary and GetProcAddress APIs, strongly suggesting the exploitation of a client-side vulnerability to execute arbitrary code. The document body contains Chinese text related to file construction and embedded objects, but does not provide direct instructions or lures.
Heuristics 5
-
Office EPRINT stream contains EMF object high OLE_EPRINT_EMF_OBJECTOLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
Reference to LoadLibrary API high SC_STR_LOADLIBRARYReference to LoadLibrary API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 378,372 bytes but its declared streams total only 31,351 bytes — 347,021 bytes (92%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.