RTF malware analysis — malicious · 07fcce867febdab6

MALICIOUS

RTF

397.5 KB First seen: 2014-02-28

MD5: d221f519c4c01ee2db8bcc48ccd14b63 SHA-1: 1ebf0e853e336df0426e178f33a13454eeaa932f SHA-256: 07fcce867febdab6edddf9950abd27351cfbc75aa988af2cfbbb948b2720ce81

262 Risk Score

Heuristics 6

ClamAV: Win.Trojan.Bifro_11-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Bifro_11-2
PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000d0.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xD0	110969 bytes
SHA-256: `b1e4fbfccc51fda08bdcbdce50ba9d112ef7e48570e88b91bc025f8851e8812b`
Detection ClamAV: Win.Trojan.Bifro_11-2 Obfuscation or payload: likely Carved artifact entropy is 7.73, consistent with packed or encrypted content.
`objdata_01_off0003987b.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3987B	45011 bytes
SHA-256: `7a616aa053e04c799acfacb2119da736b2999c95b572eb4b22d203866650c2e3`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.44, consistent with packed or encrypted content.
`objdata_02_off00051f9f.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x51F9F	30980 bytes
SHA-256: `2a3885f289e317c5f3cbded490ec686a7588e0aaac8fa9303a8a2639ea3d3876`

Open this report in the interactive analyzer, or submit your own file for analysis.