RTF malware analysis — malicious · 263be47f602b2156

MALICIOUS

RTF

160.5 KB

MD5: 24433fe5aed50417b17663e46bacf92c SHA-1: 6ff9b5c8ff0fc10f3bcce07c4f4fda2eaa351188 SHA-256: 263be47f602b2156c9282afdd6a0f1fe9bb9022cef2eb0a821e8d8153d3a8d06

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1055.012 Process Hollowing T1055.001 Process Injection

The RTF file contains references to Windows API functions such as VirtualAlloc, VirtualProtect, LoadLibrary, and GetProcAddress, which are commonly used by malware to allocate memory, load libraries, and resolve function addresses for executing shellcode. The presence of these high-severity heuristics suggests the file is designed to download and execute a secondary payload, likely through process injection or hollowing techniques. No specific family could be identified, and no direct IOCs were extracted.

Heuristics 4

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API

Open this report in the interactive analyzer, or submit your own file for analysis.