MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The file is a malicious OLE document with a significant amount of slack space, suggesting obfuscation or embedded malicious content. The heuristic firings indicate XOR-encoded strings and an embedded URL, pointing towards a downloader or droppper functionality. Although VBA macros could not be extracted due to an unsupported format, the presence of an embedded URL and encoded strings strongly suggests an attempt to deliver a secondary payload.
Heuristics 3
-
XOR-encoded strings (key 0xAC) critical SC_XOR_ENCODEDFound 8 Windows library/API name(s) XOR-encoded with single-byte key 0xAC: 'shell32.dll', 'LoadLibraryA', 'LoadLibraryA', 'VirtualAlloc', 'CreateProcessA', 'ExitProcess ', 'CreateFileA ', 'ShellExecuteA'
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 112,869 bytes but its declared streams total only 20,632 bytes — 92,237 bytes (82%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTEDolevba could not extract VBA macros (PermissionError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
Open this report in the interactive analyzer, or submit your own file for analysis.