Ghidra reverse engineering malware filled with empty space.

I have been reverse engineering a piece of malware that attacked a friend of mine. Its a single executable around 70MB and upon loading it up I noticed that the majority of it is zero'ed out memory.
In a section called .ndata 60% of the program is interpreted like this:

0047b002 ?? ??

Which I'm assuming is either some unknown data type or the creators attempt of giving the executable enough size so that someone doesn't suspect the file size …

called engineering ghidra malware memory piece program reverse reverse engineering single space