Malicious Office (OLE) / .ASP — malware analysis report

Heuristics 2

• OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
  OLE file is 82,804 bytes but its declared streams total only 0 bytes — 82,804 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
• CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
  The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Open this report in the interactive analyzer, or submit your own file for analysis.