MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The document's subject line and body text suggest a business transaction for sensitive information, acting as a lure. A critical heuristic identified an embedded PE executable, indicating the document is a dropper. The OLE slack anomaly further supports the presence of hidden or unexpected content. The embedded executable is the primary payload, likely designed to execute malicious code upon opening.
Heuristics 2
-
Embedded PE executable critical OLE_EMBEDDED_EXEMZ/PE header found inside document — possible embedded executable
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 65,536 bytes but its declared streams total only 17,048 bytes — 48,488 bytes (74%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_0000a000.exea8402d7bbfe911fac569c070746ce93c01581ce7e02cd99850107814b73797b5 |
embedded-pe | Office MZ+PE at offset 0xA000 | 24576 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.