MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059 Command and Scripting Interpreter
T1204 Malicious Link
The sample is an OLE document with a significant slack space anomaly, indicating potential obfuscation or embedded malicious content. High-severity heuristics indicate the use of Windows API functions like VirtualProtect, LoadLibrary, and GetProcAddress, which are commonly used by malware to execute arbitrary code. While no specific script was extracted, these API calls suggest the document is designed to download and execute a second-stage payload. The embedded URL, though benign, is noted.
Heuristics 5
-
Reference to LoadLibrary API high SC_STR_LOADLIBRARYReference to LoadLibrary API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 139,264 bytes but its declared streams total only 31,351 bytes — 107,913 bytes (77%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECTReference to VirtualProtect API
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main
Open this report in the interactive analyzer, or submit your own file for analysis.