MALICIOUS
180
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File
T1059.003 Windows Command Shell
The file is detected as Win.Exploit.MSWord-7, indicating it leverages a known exploit. Static analysis revealed a call to GetPC stub and XOR-encoded strings, suggesting obfuscated code execution. The heuristic 'push-string-call' decoded to 'wc.exe', likely an indicator of a dropped or executed payload. The document body contains heavily garbled text, offering no contextual clues about the lure.
Heuristics 4
-
XOR-encoded strings (key 0x88) critical SC_XOR_ENCODEDFound 6 Windows library/API name(s) XOR-encoded with single-byte key 0x88: 'KERNEL32.DLL', 'LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'VirtualProtect', 'ExitProcess '
-
ClamAV: Win.Exploit.MSWord-7 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Exploit.MSWord-7
-
x86 GetPC stub (CALL $+5; POP EBX) high SC_GETPC_CALLx86 GetPC stub (CALL $+5; POP EBX)
-
x86 push-string-call medium SC_PUSH_STRINGShellcode-style PUSH imm32 sequence builds an execution, network, or Windows API string on the stack
Open this report in the interactive analyzer, or submit your own file for analysis.