MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1027 Obfuscated Files or Information
The sample is an OLE document with a high degree of slack space, indicating an attempt to conceal its true contents. Heuristic analysis detected XOR-encoded strings, a common obfuscation technique used to hide malicious code or configuration data. The GetPC stub is often used in shellcode to locate its own entry point. Without further analysis of the encoded strings or any embedded scripts, the exact payload and delivery mechanism remain unclear.
Heuristics 3
-
XOR-encoded strings (key 0x23) critical SC_XOR_ENCODEDFound 8 Windows library/API name(s) XOR-encoded with single-byte key 0x23: 'kernel32.dll', 'kernel32.dll', 'cabinet.dll', 'iphlpapi.dll', 'iphlpapi.dll', 'LoadLibraryA', 'LoadLibraryA', 'LoadLibraryA'
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 312,816 bytes but its declared streams total only 16,536 bytes — 296,280 bytes (95%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.