MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious File
The file is a Microsoft Word document exhibiting a significant amount of slack space, which is often used to hide malicious content. The 'GetPC stub' heuristic firing further suggests the presence of executable code within the document. Without a document body or scripts, the exact malicious intent cannot be determined, but the structure is indicative of a malicious container.
Heuristics 2
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 128,001 bytes but its declared streams total only 16,536 bytes — 111,465 bytes (87%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.