MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
The OLE document exhibits a significant slack space anomaly (93%), which is a strong indicator of malicious intent, potentially as a container for exploits or further payloads. The presence of a NOP-equivalent sled and a GetPC stub further supports this assessment. No document body or scripts were extracted, limiting the ability to determine the specific attack vector or family.
Heuristics 3
-
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EAX)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 251,913 bytes but its declared streams total only 16,543 bytes — 235,370 bytes (93%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLEDLong run of 0x61 bytes
Open this report in the interactive analyzer, or submit your own file for analysis.