Xls.Dropper.Agent-7670001-0 — RTF malware analysis

Static analysis result for SHA-256 24756c86a6492fe0…

MALICIOUS

RTF

1.32 MB Created: 2020-03-31 21:58:00
MD5: 97e1798262f013cbb0a6876835d33fcc SHA-1: 65f2aa9ee3b26ea6cde5350a4b841a3fba2aebd9 SHA-256: 24756c86a6492fe06b2f7ec06935a0c4ea038d77062ae377674e3bef40120f3b
180 Risk Score

Malware Insights

Xls.Dropper.Agent-7670001-0 · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1137.001 DLL Search Order Hijacking

The RTF file exhibits multiple high-severity heuristics indicating the presence of embedded OLE objects containing significant amounts of hex-encoded data, a common technique for hiding malicious payloads. ClamAV detection confirms this as 'Xls.Dropper.Agent-7670001-0', a known dropper. The objupdate heuristic suggests that these embedded objects are designed to be activated, likely to execute the hidden payload.

Heuristics 6

  • ClamAV: Xls.Dropper.Agent-7670001-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7670001-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~1071KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 16 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002cbb.bin
5ad06cc13a475f5969bf27e7d65893471714460c628962f6dc3c68277ebcbe85		 rtf-objdata-decoded RTF \objdata at offset 0x2CBB 39982 bytes
objdata_02_off0002bb76.bin
385444be665c90a86b0fce3168308d5de88108f808222111fe800e9cda71ebd4		 rtf-objdata-decoded RTF \objdata at offset 0x2BB76 39982 bytes
objdata_07_off000922db.bin
4d8624724a19d3a4e057086a1c8e281afaa66067828ea1ec1481a14d22a7d399		 rtf-objdata-decoded RTF \objdata at offset 0x922DB 39982 bytes
objdata_11_off000e425f.bin
86eadb7dea42f74e6063148633a35c37307eb4fb14faa91c3887fd5b4ba44c6b		 rtf-objdata-decoded RTF \objdata at offset 0xE425F 39982 bytes
objdata_15_off001361e3.bin
e153ad8b84dae05d4701b4d5da730ceeea369d0c742b1db6ffbb21735b03c2f3		 rtf-objdata-decoded RTF \objdata at offset 0x1361E3 39982 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.