MALICIOUS
220
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1059.003 Windows Command Shell
The file is identified as malicious by ClamAV with the signature Win.Exploit.MSWord-7. Static analysis revealed an x86 GetPC stub and an x86 push-string-call that decodes to 'wc.exe', indicating an attempt to execute a command. Additionally, XOR-encoded strings were detected, suggesting obfuscation of malicious content. The large slack space in the OLE structure is also a common characteristic of weaponized documents.
Heuristics 5
-
XOR-encoded strings (key 0xC4) critical SC_XOR_ENCODEDFound 5 Windows library/API name(s) XOR-encoded with single-byte key 0xC4: 'msvcrt.dll ', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'CreateProcessA'
-
ClamAV: Win.Exploit.MSWord-7 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Exploit.MSWord-7
-
x86 GetPC stub (CALL $+5; POP EBX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EBX)
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 227,146 bytes but its declared streams total only 94,801 bytes — 132,345 bytes (58%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
x86 push-string-call medium SC_PUSH_STRINGShellcode-style PUSH imm32 sequence builds an execution, network, or Windows API string on the stack
Open this report in the interactive analyzer, or submit your own file for analysis.