MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.001 Spearphishing Attachment
The OLE document contains an embedded PE executable, identified by the OLE_EMBEDDED_EXE heuristic. This suggests the document is a dropper or container for a malicious payload. The presence of a NOP sled and a push-string-call heuristic further indicate shellcode or exploit activity within the document. The document body text is nonsensical and likely obfuscated or placeholder content.
Heuristics 4
-
Embedded PE executable critical OLE_EMBEDDED_EXEMZ/PE header found inside document — possible embedded executable
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 60,944 bytes but its declared streams total only 16,490 bytes — 44,454 bytes (73%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
x86 push-string-call medium SC_PUSH_STRINGShellcode-style PUSH imm32 sequence builds an execution, network, or Windows API string on the stack
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_00004b00.exe6652fed97617e487ec02d18e4020c80325300cb55dc162e06ecadb2d89905775 |
embedded-pe | Office MZ+PE at offset 0x4B00 | 41744 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.