MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The sample is a malicious OLE document that contains a large amount of slack space, indicating potential obfuscation or embedded content. A high-severity heuristic firing for ShellExecute API usage suggests the document is designed to launch an external process. The document body is heavily obfuscated and unreadable, providing no direct clues to the attack's intent. Given the ShellExecute firing, the most likely attack pattern is that the document attempts to download and execute a second-stage payload.
Heuristics 2
-
Reference to ShellExecute API high SC_STR_SHELLEXECReference to ShellExecute API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 948,224 bytes but its declared streams total only 94,801 bytes — 853,423 bytes (90%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.