MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1027 Obfuscated Files or Information
The critical SC_XOR_ENCODED heuristic indicates that strings within the file are XOR-encoded with a key of 0xDE, suggesting an attempt to obfuscate malicious code. The high OLE_SLACK_ANOMALY firing points to a large, unaccounted-for region within the OLE structure, often used to hide payloads. The reference to VirtualAlloc API further suggests memory manipulation for executing code. These factors combined indicate a downloader or dropper.
Heuristics 3
-
XOR-encoded strings (key 0xDE) critical SC_XOR_ENCODEDFound 5 Windows library/API name(s) XOR-encoded with single-byte key 0xDE: 'GetProcAddress', 'CreateProcessA', 'ExitProcess ', 'CreateFileA ', 'CreateFileW '
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 121,067 bytes but its declared streams total only 56,346 bytes — 64,721 bytes (53%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOCReference to VirtualAlloc API
Open this report in the interactive analyzer, or submit your own file for analysis.