MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The sample is a malicious OLE document that exhibits high heuristic firings for XOR-encoded strings and an unusual amount of slack space, indicating obfuscation and potential malicious content. The GetPC stub suggests an attempt to execute code, likely exploiting a vulnerability within Microsoft Word.
Heuristics 3
-
XOR-encoded strings (key 0x23) critical SC_XOR_ENCODEDFound 8 Windows library/API name(s) XOR-encoded with single-byte key 0x23: 'kernel32.dll', 'kernel32.dll', 'iphlpapi.dll', 'LoadLibraryA', 'LoadLibraryA', 'GetProcAddress', 'GetProcAddress', 'VirtualAlloc'
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 187,376 bytes but its declared streams total only 16,536 bytes — 170,840 bytes (91%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.