RTF malware analysis — malicious · 18f06be5fe67e935

MALICIOUS

RTF

70.5 KB Created: 2010-06-24 17:20:00 Authoring application: Microsoft Word 11.0.0000

MD5: a1da01d4b06fed818199b9c627cd149e SHA-1: bef6f65e62d22a998dc82f77624324b8f9b128ab SHA-256: 18f06be5fe67e9353cc86c88cf026750e452fbbe65f12a4124620c6375bee768

262 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object which is identified as a PE executable by ClamAV. This suggests the document is designed to trick the user into opening or interacting with the embedded file, leading to the execution of malware. The embedded artifact is a binary file, likely a second-stage payload.

Heuristics 7

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Win.Spyware.73855-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Spyware.73855-2
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001012.bin` `4e0efc79f8dbe51a4d6aedc18b2802342de97d94660234ce66b9a59ccd8e7989`	rtf-objdata-decoded	RTF \objdata at offset 0x1012	33266 bytes
Detection ClamAV: Win.Spyware.73855-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.