MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file is identified as malicious by ClamAV with the signature Doc.Downloader.Inject-118, indicating it's a downloader. The document body appears to be a press release but contains significant amounts of garbled text, suggesting an attempt to obfuscate malicious content. The presence of XOR-encoded strings further supports the likelihood of obfuscation for malicious purposes.
Heuristics 3
-
ClamAV: Doc.Downloader.Inject-118 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Inject-118
-
XOR-encoded strings (key 0x85) critical SC_XOR_ENCODEDFound 5 Windows library/API name(s) XOR-encoded with single-byte key 0x85: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'VirtualProtect'
Disassembly
Attempted x86 opcode disassembly0000B6DC ce into 0000B6DD c0d7cb rcl bh, 0xcb 0000B6E0 c0c9b6 ror cl, 0xb6 0000B6E3 b7ab mov bh, 0xab 0000B6E5 c1c9c9 ror ecx, 0xc9 0000B6E8 00d6 add dh, dl 0000B6EA cdc0 int 0xc0 0000B6EC c9 leave 0000B6ED c9 leave 0000B6EE b6b7 mov dh, 0xb7 0000B6F0 ab stosd dword ptr es:[edi], eax 0000B6F1 e1e9 loope 0xb6dc 0000B6F3 e90000c9ea jmp 0xeac9b6f8 0000B6F8 e4e1 in al, 0xe1 0000B6FA c9 leave 0000B6FB ec in al, dx 0000B6FC e7f7 out 0xf7, eax 0000B6FE e4f7 in al, 0xf7 0000B700 fc cld 0000B701 c400 les eax, ptr [eax] 0000B703 00c2 add dl, al 0000B705 e0f1 loopne 0xb6f8 0000B707 d5f7 aad 0xf7 0000B709 eae6c4e1e1f7e0 ljmp 0xe0f7:0xe1e1c4e6 0000B710 f6f6 div dh 0000B712 0000 add byte ptr [eax], al 0000B714 d3ec shr esp, cl 0000B716 f7f1 div ecx 0000B718 f0 .byte 0xf0 0000B719 e4e9 in al, 0xe9 0000B71B d5f7 aad 0xf7 0000B71D eaf1e0e6f10000 ljmp 0:0xf1e6e0f1 0000B724 d3ec shr esp, cl 0000B726 f7f1 div ecx 0000B728 f0 .byte 0xf0 0000B729 e4e9 in al, 0xe9 0000B72B c4 .byte 0xc4 0000B72C e9e9eae600 jmp 0xe7a21a 0000B731 00d3 add bl, dl 0000B733 ec in al, dx 0000B734 f7f1 div ecx 0000B736 f0 .byte 0xf0 0000B737 e4e9 in al, 0xe9 0000B739 c3 ret 0000B73A f7e0 mul eax
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 47,120 bytes but its declared streams total only 18,279 bytes — 28,841 bytes (61%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.