MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1559.001 Component Object Model Hijacking
T1204.002 Malicious File
The RTF document contains embedded OLE object data, specifically a Package object, which is a known technique for delivering malicious payloads. The critical heuristic firing RTF_MZ_HEX indicates the presence of a PE header within the RTF's hex data, pointing to an embedded executable. The extracted data reveals a path 'C:\backuped.exe' and a filename '3.ico', suggesting the embedded PE is disguised as an icon file but intended to be executed. The embedded PE itself is likely the payload, and the RTF serves as the initial delivery vector.
Heuristics 4
-
PE header (with DOS stub) in hex data critical RTF_MZ_HEXHex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
-
Package object class high RTF_OBJCLASS_PACKAGEOLE Package object — can wrap arbitrary files
-
OLE object data medium RTF_OBJDATARTF contains 1 \objdata section(s) — embedded OLE objects
-
Embedded OLE object medium RTF_OBJEMBRTF contains \objemb — embedded OLE object
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
objdata_00_off000000cf.bineef14bc847514f204a9fe8f9d445da403ff10d335954bae1d7afa44e02dd721d |
rtf-objdata-decoded | RTF \objdata at offset 0xCF | 31841 bytes |
embedded_rtf_000001e8.exefd916be5c37f3d3be27f0ab687af5359e93579d05ee1a8a34f044dcecd35b2c6 |
embedded-pe | RTF hex-encoded MZ at offset 0x1E8 | 31711 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.