MALICIOUS
142
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1027 Obfuscated Files or Information
The sample exhibits characteristics of malicious documents, including a NOP sled and XOR-encoded strings, indicating an attempt to hide malicious code. The OLE document structure shows a significant amount of slack space, often used for embedding malicious content. Although VBA macros could not be extracted due to an unsupported format, the presence of embedded URLs and the overall heuristic firings strongly suggest that this document is designed to download and execute a second-stage payload.
Heuristics 4
-
XOR-encoded strings (key 0xE5) critical SC_XOR_ENCODEDFound 5 Windows library/API name(s) XOR-encoded with single-byte key 0xE5: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualProtect', 'ExitProcess '
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 84,252 bytes but its declared streams total only 18,337 bytes — 65,915 bytes (78%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTEDolevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
Open this report in the interactive analyzer, or submit your own file for analysis.