MALICIOUS
100
Risk Score
Malware Insights
The sample exhibits critical heuristics for XOR-encoded strings and a large amount of slack space within the OLE structure, indicating obfuscation and potential for hidden malicious content. The XOR key 0xA4 was identified, suggesting a method for hiding malicious commands or URLs. While no specific VBA or script content was directly extracted, these heuristics strongly suggest the document is designed to execute a secondary payload, likely via Visual Basic for Applications, hence the T1059.005 technique.
Heuristics 2
-
XOR-encoded strings (key 0xA4) critical SC_XOR_ENCODEDFound 4 Windows library/API name(s) XOR-encoded with single-byte key 0xA4: 'LoadLibraryA', 'CreateProcessA', 'ExitProcess ', 'CreateFileA '
Disassembly
Attempted x86 opcode disassembly00000889 e8cbc5c0e8 call 0xe8c0ce59 0000088E cdc6 int 0xc6 00000890 d6 salc 00000891 c5 .byte 0xc5 00000892 d6 salc 00000893 dde5 fucom st(5) 00000895 a4 movsb byte ptr es:[edi], byte ptr [esi] 00000896 f35b pop ebx 00000898 742d je 0x8c7 0000089A 2108 and dword ptr [eax], ecx 0000089C 59 pop ecx 0000089D 5b pop ebx 0000089E 5b pop ebx 0000089F c52f lds ebp, ptr [edi] 000008A1 2110 and dword ptr [eax], edx 000008A3 59 pop ecx 000008A4 5b pop ebx 000008A5 5b pop ebx 000008A6 2d21f0595b sub eax, 0x5b59f021 000008AB 5b pop ebx 000008AC 2f das 000008AD 2910 sub dword ptr [eax], edx 000008AF 59 pop ecx 000008B0 5b pop ebx 000008B1 5b pop ebx 000008B2 27 daa 000008B3 65b42d mov ah, 0x2d 000008B6 29605a sub dword ptr [eax + 0x5a], esp 000008B9 5b pop ebx 000008BA 5b pop ebx 000008BB 2f das 000008BC 3110 xor dword ptr [eax], edx 000008BE 59 pop ecx 000008BF 5b pop ebx 000008C0 5b pop ebx 000008C1 27 daa 000008C2 66842d316c5a5b test byte ptr [0x5b5a6c31], ch 000008C9 5b pop ebx 000008CA 2f das 000008CB 2110 and dword ptr [eax], edx 000008CD 59 pop ecx 000008CE 5b pop ebx 000008CF 5b pop ebx 000008D0 2f das 000008D1 ec in al, dx 000008D2 e22d loop 0x901 000008D4 e97c2f3110 jmp 0x10313855 000008D9 59 pop ecx 000008DA 5b pop ebx 000008DB 5b pop ebx 000008DC 2f das 000008DD e6ee out 0xee, al 000008DF 2de1782f29 sub eax, 0x292f78e1 000008E4 10595b adc byte ptr [ecx + 0x5b], bl 000008E7 5b pop ebx 000008E8 2f das
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 80,385 bytes but its declared streams total only 20,635 bytes — 59,750 bytes (74%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.