Office document is digitally signed

OFFICE_DOC_SIGNED

← All detection heuristics · Office

info OFFICE_DOC_SIGNED

What it means

The document/package carries a whole-document digital signature.

Why it fires

Office can seal a whole document — distinct from a VBA-project signature — via an OOXML XML-DSig part (_xmlsignatures/sig*.xml) or a legacy-OLE \x05DigitalSignature PKCS#7 stream. The signer certificate, issuer and validity are shown for context. Presence of a signature is NOT by itself a benign indicator and does not affect the risk score. Legacy-OLE signatures are cryptographically self-consistency checked; OOXML XML-DSig is surfaced for identity but its signature value is not recomputed (no XML canonicalization in the sandbox), so it shows as 'unverified' rather than risking a false 'invalid'.

Other Office heuristics

OLE_VBA_AFFINE_MSI_DOWNLOADER OLE_VBA_AUTOEXEC_FRAGMENTED_SHELL OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN OLE_VBA_BIDIRECTIONAL_MACROCOPY_REPLICATION OOXML_BRAND_LINK_MISMATCH_LURE CVE_2016_7262 POLYGLOT_OOXML_REL_COMMAND OLE_RAW_PCODE_CROSS_DOCUMENT_REPLICATION OLE_VBA_CROSS_WORKBOOK_REPLICATION OOXML_XLM_DANGEROUS_FN OFFICE_DEFAULT_PASSWORD_VBA_DROP_EXEC OFFICE_EMBEDDED_SWF EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE OFFICE_EMBEDDED_MACRO_OBJECT OLE_EMBEDDED_EXE OLE_VBA_EMBEDDED_PE_DROPPER OLE_ENCRYPTED_AND_MALFORMED CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED CVE_2017_11882 OLE_EQUATION_OLE10NATIVE_DOWNLOADER OLE_MTEF_NATIVE_CODE_STUB OLE_EQUATION_OLE10NATIVE_SHELLCODE OOXML_XLM_MACRO_IN_WORKSHEET OLE_XLS5_LAROUX_MACRO_VIRUS