MALICIOUS
260
Risk Score
Malware Insights
MITRE ATT&CK
T1059.003 Windows Command Shell
T1204.002 Malicious File
T1055 Process Injection
The sample exhibits high-confidence heuristic firings for WinExec, CreateProcess, LoadLibrary, and GetProcAddress, indicating dynamic code execution capabilities. A suspicious cmd.exe invocation with an execution flag was also detected. The OLE slack anomaly suggests potential obfuscation or padding within the document structure. While an embedded URL was found, it was confirmed as benign, and no scripts were extracted. The combination of API calls strongly suggests the document is designed to execute arbitrary code, likely a downloader.
Heuristics 8
-
Reference to WinExec API high SC_STR_WINEXECReference to WinExec API
-
Reference to CreateProcess API high SC_STR_CREATEPROCESSReference to CreateProcess API
-
Suspicious cmd.exe invocation with execution flag high SC_STR_CMDSuspicious cmd.exe invocation with execution flag
-
Reference to LoadLibrary API high SC_STR_LOADLIBRARYReference to LoadLibrary API
-
Reference to GetProcAddress API high SC_STR_GETPROCADDRESSReference to GetProcAddress API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 130,855 bytes but its declared streams total only 31,351 bytes — 99,504 bytes (76%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOCReference to VirtualAlloc API
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.hrw.org/europecentral-asia/kyrgyzstan\par
Open this report in the interactive analyzer, or submit your own file for analysis.