RTF malware analysis — malicious · 0b85869a45145b51

MALICIOUS

RTF

142.4 KB Authoring application: Msftedit 5.41.21.2509

MD5: 10930db722ba4dbd2cb1b694e8d0d730 SHA-1: eae3ae1c188cb7cced664ffd831f6f5e1df67fc6 SHA-256: 0b85869a45145b51a143c8364a7fe7e994c3ce2d555aac68e099721e1a2a2592

140 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains embedded OLE objects, including a package object and a PE header in hex data. This strongly suggests the RTF is a container for a malicious executable payload. The file's SHA256 hash is provided as an IOC. The primary attack pattern is likely spearphishing attachment, leading to exploitation for client execution.

Heuristics 4

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000124.bin` `978b49672cdf1dd205675bde3661735fe5a7103875cc67fba4e75132de94d91a`	rtf-objdata-decoded	RTF \objdata at offset 0x124	67177 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.