MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The sample is a Microsoft Word document exhibiting an OLE slack anomaly and containing XOR-encoded strings, indicating obfuscation. The presence of these indicators suggests the document is designed to exploit a vulnerability, likely to download and execute a secondary payload. The specific nature of the exploit or payload could not be determined due to the lack of script content and the obfuscated nature of the document body.
Heuristics 2
-
XOR-encoded strings (key 0x92) critical SC_XOR_ENCODEDFound 2 Windows library/API name(s) XOR-encoded with single-byte key 0x92: 'advapi32.dll', 'shell32.dll'
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 49,152 bytes but its declared streams total only 23,704 bytes — 25,448 bytes (52%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.