MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file is identified as malicious by ClamAV with the signature Win.Trojan.Tristate-2. The document body explicitly warns of a macro virus infection, indicating a social engineering tactic to prompt the user to enable macros. The large slack space in the OLE structure is also anomalous, though its specific role is unclear without further analysis.
Heuristics 2
-
ClamAV: Win.Trojan.Tristate-2 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.Tristate-2
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 52,736 bytes but its declared streams total only 18,572 bytes — 34,164 bytes (65%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.