MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
T1027 Obfuscated Files or Information
The presence of LoadLibrary and GetProcAddress API calls, along with a significant slack space anomaly in the OLE structure, indicates the document likely contains embedded shellcode or exploits. While no specific document body text or scripts were extracted, these indicators suggest the file is designed to download and execute a second-stage payload, a common technique for unknown malware families.
Heuristics 3
-
Reference to LoadLibrary API high SC_STR_LOADLIBRARYReference to LoadLibrary API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 210,176 bytes but its declared streams total only 94,801 bytes — 115,375 bytes (55%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.