← All detection heuristics · Office / OLE
critical
OLE_SLACK_XOR_SCRIPT_BACKDOOR
What it means
An XOR-hidden script performs network retrieval, host fingerprinting, remote command evaluation, and result posting.
Why it fires
The decoded slack region combines a COM HTTP client, system identity collection, command decoding/evaluation, and response submission. This is a complete remote-command backdoor chain. Recovered URLs retain their XOR key/source provenance and the JavaScript is preserved for review.
Other Office / OLE heuristics
OLE_VBA_SCHTASKS_SCRIPT_PERSISTENCE OLE_VBA_UNC_EXECUTABLE_LAUNCH OLE_VBA_EMITTED_SCRIPT OLE_SLACK_XOR_SCRIPT OLE_SLACK_XOR_SCRIPT_CONFIG OLE_VBA_BASE64_NETWORK_IOC OLE_EICAR_DISPLAY_TEST OLE_BIFF_MAILTO_HYPERLINK OLE_BIFF_HLINK_NETWORK_URI OLE_BIFF_EXTERNAL_WORKBOOK_URI OLE_METADATA_UNC_PATH OLE_WORD_KGWEBURL