RTF malware analysis — malicious · 233af6f15c6464d4

MALICIOUS

RTF

1.15 MB First seen: 2022-08-01

MD5: ff1c3468a329e52bcfcc8232d46e5967 SHA-1: 5befeca1be62fd5962b132ac3abdbe22bfe4908f SHA-256: 233af6f15c6464d4fdc7be4e4c21783b976f4c78e76a27ebbbca4bb03e182394

262 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell T1105 Ingress Tool Transfer

The RTF file contains a large amount of hex-encoded data within an OLE object, which is a common technique for hiding malicious payloads. ClamAV detections indicate this is a dropper for a trojan, likely AsyncRAT. The embedded PE file, 'embedded_rtf_000016bc.exe', is the primary payload, and the RTF structure itself is used to deliver it.

Heuristics 7

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Rtf.Dropper.Agent-9965975-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.Agent-9965975-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1198KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000126a.bin` `f3f29c629994d45348d8ba6e8339486dc389f42e67db5f932dc9d1813ea42d7b`	rtf-objdata-decoded	RTF \objdata at offset 0x126A	599297 bytes
Detection ClamAV: Win.Trojan.AsyncRAT-9914220-0 Obfuscation or payload: likely Carved artifact entropy is 7.89, consistent with packed or encrypted content.
`embedded_rtf_000016bc.exe` `650d50c85ef5ffad2c125f6de07a8762e898a123d98f8828a095b1273b3d2a81`	embedded-pe	RTF hex-encoded MZ at offset 0x16BC	599202 bytes
Detection ClamAV: Win.Trojan.AsyncRAT-9914220-0 Obfuscation or payload: likely Carved artifact entropy is 7.89, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.