RTF malware analysis — malicious · 05ce4c14144b9935

MALICIOUS

RTF

663.5 KB Created: 2017-11-09 04:09:00 First seen: 2021-02-23

MD5: e6ceb5134b56fa6a7edf3de2a6048a48 SHA-1: 9364c033685e875059b47c86143ec21cfe167b65 SHA-256: 05ce4c14144b9935de8d30dee60dfaa513bebdccb35099c8892ece10c86f0a6d

162 Risk Score

Heuristics 4

ClamAV: Doc.Macro.Obfuscation-6391394-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Macro.Obfuscation-6391394-0
OLE object data medium RTF_OBJDATA

RTF contains 10 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000028fd.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x28FD	21057 bytes
SHA-256: `c3c51abdd0a6e0ddef9b0fa4676bdb8c46d578eece193036e49ffd81d287aa84`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_01_off000124be.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x124BE	21057 bytes
SHA-256: `d7b99f90f7ffd9188d5cdaabb45c5a1946e2c756e707f97b136bcda4600526be`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_02_off0002207f.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2207F	21057 bytes
SHA-256: `51a25a053c082c52159862ac4914e0296d7565ed9ff7cb311f814c46ae72962e`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_03_off00031c40.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x31C40	21057 bytes
SHA-256: `2bcefa6bbf1dedceb95255c10f3c0c286bfdb2605c6b60f85440e5bd06c07c8e`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_04_off00041801.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x41801	21057 bytes
SHA-256: `320105ae3d569b0344534eb957fa65fef1b5589e07e8cc0efe0595c74e770c97`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_05_off000513c2.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x513C2	21057 bytes
SHA-256: `493c20a9b7f7f651b95752c0cc02eab3ccb511de6f5067b7e67a9c54a43c8fc9`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_06_off00060f83.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x60F83	21057 bytes
SHA-256: `ad1191820d2acc14d04e7917867768673e14d80e58363ffb960a3028f553c1ea`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_07_off00070b44.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x70B44	21057 bytes
SHA-256: `0945d2e83a8d4998713346b56630068dbe0c6c5da95143b86573ae8235688c7b`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_08_off00080705.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x80705	21057 bytes
SHA-256: `fc06af621e97193dd94e2a293e3940e39ceed4ad2c4ae9080b1c4ba25e8e00c4`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_09_off000902c6.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x902C6	21057 bytes
SHA-256: `a933fac60690ff01b995edda12da63973ac1433781ab24d2a88d945d3ddd5182`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.