MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1027 Obfuscated Files or Information
The sample is a PowerPoint file exhibiting characteristics of malicious intent, including a large slack space anomaly and the presence of a NOP sled. Crucially, XOR-encoded strings were detected with a key of 0xF0, indicating obfuscation techniques commonly used to hide malicious code. While no specific document body content or scripts were clearly extracted for analysis, these heuristics strongly suggest the file is designed to execute obfuscated code, likely for payload delivery.
Heuristics 3
-
XOR-encoded strings (key 0xF0) critical SC_XOR_ENCODEDFound 1 Windows library/API name(s) XOR-encoded with single-byte key 0xF0: 'ADVAPI32.DLL'
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 984,622 bytes but its declared streams total only 18,081 bytes — 966,541 bytes (98%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.