MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious File
T1059 Command and Scripting Interpreter
The presence of a SC_STR_CREATEPROCESS heuristic firing indicates the document likely attempts to execute a process. The OLE slack anomaly suggests potential obfuscation or embedded malicious content. The document body contains references to embedded Office objects, which could be used to hide malicious code or exploit.
Heuristics 2
-
Reference to CreateProcess API high SC_STR_CREATEPROCESSReference to CreateProcess API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 104,448 bytes but its declared streams total only 31,351 bytes — 73,097 bytes (70%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.