MALICIOUS
200
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.001 Spearphishing Attachment
T1105 Ingress Tool Transfer
The document contains an embedded PE executable, indicated by the OLE_EMBEDDED_EXE heuristic. The presence of CreateProcess API references suggests an attempt to launch this embedded executable. The XOR-encoded strings and slack space anomaly are common obfuscation techniques used by malware. The embedded executable is the primary indicator of malicious intent, likely serving as a dropper for further malicious activity.
Heuristics 4
-
XOR-encoded strings (key 0x88) critical SC_XOR_ENCODEDFound 8 Windows library/API name(s) XOR-encoded with single-byte key 0x88: 'wininet.dll', 'LoadLibraryA', 'GetProcAddress', 'CreateProcessA', 'CreateFileA ', 'InternetOpenA', 'HttpOpenRequestA', 'HttpSendRequestA'
-
Embedded PE executable critical OLE_EMBEDDED_EXEMZ/PE header found inside document — possible embedded executable
-
Reference to CreateProcess API high SC_STR_CREATEPROCESSReference to CreateProcess API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 110,725 bytes but its declared streams total only 31,351 bytes — 79,374 bytes (72%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
embedded_office_00012e20.exe89e54ae49a4a083a3cfea7a2867341b0dd3fdd60b166a62c9487491f123800bd |
embedded-pe | Office MZ+PE at offset 0x12E20 | 33381 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.