MALICIOUS
140
Risk Score
Malware Insights
The sample is a malicious OLE document containing a NOP sled and XOR-encoded strings, indicating obfuscated malicious content. The large slack space in the OLE structure further suggests the presence of hidden or packed data. While no specific VBA scripts were extracted, the heuristics strongly suggest the document is designed to execute malicious code, likely through embedded macros, to achieve its malicious objective.
Heuristics 3
-
XOR-encoded strings (key 0x95) critical SC_XOR_ENCODEDFound 3 Windows library/API name(s) XOR-encoded with single-byte key 0x95: 'LoadLibraryA', 'GetProcAddress', 'RegOpenKeyExA'
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 93,181 bytes but its declared streams total only 16,486 bytes — 76,695 bytes (82%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.