MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059 Command and Scripting Interpreter
The file is an OLE document with a significant slack anomaly, indicating potential obfuscation or embedded malicious content. A reference to the CreateProcess API was detected, along with XOR-encoded strings, suggesting the execution of external code. The document body contains references to embedded Excel and PowerPoint objects, which could be used to deliver further payloads.
Heuristics 3
-
XOR-encoded strings (key 0x88) critical SC_XOR_ENCODEDFound 8 Windows library/API name(s) XOR-encoded with single-byte key 0x88: 'wininet.dll', 'LoadLibraryA', 'GetProcAddress', 'CreateProcessA', 'CreateFileA ', 'InternetOpenA', 'HttpOpenRequestA', 'HttpSendRequestA'
-
Reference to CreateProcess API high SC_STR_CREATEPROCESSReference to CreateProcess API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 120,968 bytes but its declared streams total only 31,351 bytes — 89,617 bytes (74%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.