MALICIOUS
220
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The sample is a malicious OLE document containing a large slack space anomaly and multiple high-severity heuristic firings. These include detection of a NOP sled, PEB access, and an API-hash resolver, indicating attempts to obfuscate and execute shellcode. The critical finding of XOR-encoded strings with a key of 0xFF suggests the presence of obfuscated malicious content within the document. While no specific exploit is identified, the combination of these indicators points to a likely attempt to execute arbitrary code upon opening.
Heuristics 5
-
XOR-encoded strings (key 0xFF) critical SC_XOR_ENCODEDFound 8 Windows library/API name(s) XOR-encoded with single-byte key 0xFF: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'VirtualProtect', 'ExitProcess ', 'CreateFileA ', 'OpenProcess '
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
-
PEB API-hash resolver high SC_API_HASH_RESOLVERPEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 128,097 bytes but its declared streams total only 61,092 bytes — 67,005 bytes (52%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.