MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1204 Malicious File
The file is a malicious OLE document. Static analysis revealed a NOP sled and a significant slack space anomaly, indicating the document is likely packed or obfuscated to hide malicious content. The exact exploit or payload could not be determined from the available heuristics.
Heuristics 2
-
NOP sled detected high SC_NOP_SLEDFound 20+ consecutive 0x90 bytes
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 101,376 bytes but its declared streams total only 20,635 bytes — 80,741 bytes (80%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Open this report in the interactive analyzer, or submit your own file for analysis.