MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious File
T1059 Command and Scripting Interpreter
The file is identified as malicious by ClamAV with the signature Win.Trojan.Agent-30229. The OLE document exhibits a large slack space anomaly, suggesting it may contain hidden or obfuscated data. The document body contains heavily corrupted or unprintable characters, indicating it is not intended for direct user consumption and likely serves as a lure or container for malicious content. The combination of these factors points to a malicious document designed to exploit vulnerabilities and download further payloads.
Heuristics 2
-
ClamAV: Win.Trojan.Agent-30229 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.Agent-30229
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 528,993 bytes but its declared streams total only 94,801 bytes — 434,192 bytes (82%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.