MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The sample is an OLE document with a significant amount of slack space, indicating potential obfuscation or embedded malicious content. A high-severity heuristic firing for CreateProcess API suggests the document is designed to launch an external process. The document body is heavily corrupted and unreadable, providing no further context on the lure. Without readable document body or script content, the exact payload and delivery mechanism remain unclear, leading to an unknown family classification.
Heuristics 2
-
Reference to CreateProcess API high SC_STR_CREATEPROCESSReference to CreateProcess API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 62,754 bytes but its declared streams total only 20,632 bytes — 42,122 bytes (67%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.