CVE-2012-0158 RTF embedded encrypted payload

Inside a document already attributed to CVE-2012-0158, the scanner found a contiguous binary region of at least 8 KB whose Shannon entropy exceeds 7.0. Hex-encoded \objdata text cannot exceed entropy 4.0 (16 symbols), so a region this random is genuine binary, not encoded markup — the staged payload (typically embedded in the \datastore group) that the exploit shellcode decrypts and writes to disk. It is surfaced as an IOC (offset, size, SHA-256); the bytes are encrypted, so the analyzer reports the blob rather than a decoded PE.