MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The sample exhibits an OLE slack space anomaly and contains XOR-encoded strings, indicating a malicious document designed to exploit vulnerabilities. The presence of these indicators suggests an attempt to download and execute a secondary payload, though the specific mechanism is obscured. The document body is heavily corrupted and does not provide further context.
Heuristics 2
-
XOR-encoded strings (key 0x95) critical SC_XOR_ENCODEDFound 5 Windows library/API name(s) XOR-encoded with single-byte key 0x95: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'VirtualProtect'
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 100,608 bytes but its declared streams total only 16,486 bytes — 84,122 bytes (84%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.