MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1027 Obfuscated Files or Information
The sample is an OLE file that failed VBA extraction due to an unsupported format. However, heuristics indicate the presence of XOR-encoded strings and a reference to VirtualAlloc, suggesting malicious code execution. The obfuscated nature and inability to extract VBA macros point towards an attempt to hide malicious functionality, likely a downloader. Without extractable VBA, the exact payload and delivery mechanism remain unclear.
Heuristics 3
-
XOR-encoded strings (key 0xDE) critical SC_XOR_ENCODEDFound 5 Windows library/API name(s) XOR-encoded with single-byte key 0xDE: 'GetProcAddress', 'CreateProcessA', 'ExitProcess ', 'CreateFileA ', 'CreateFileW '
-
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOCReference to VirtualAlloc API
-
Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTEDolevba could not extract VBA macros (AttributeError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
Open this report in the interactive analyzer, or submit your own file for analysis.