RTF malware analysis — malicious · 4064bf783cfcd423

MALICIOUS

RTF

104.0 KB Created: 2010-03-25 09:23:00

MD5: 0068c1345a9b187997c1fd7e21ca1a59 SHA-1: 8aa303821ff4fe0c8f4d1f5fc102fa8202cfbf35 SHA-256: 4064bf783cfcd423bc0f379ce980900d6f1f4e8501093fc9808830856f084170

260 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1129 Execution through API execution

The RTF file contains an embedded OLE object which, when decoded, reveals a PE executable. Heuristics indicate this is a malicious payload, specifically identified by ClamAV as Win.Trojan.Clicker-4220. The embedded object is the primary mechanism for delivering the malicious executable, suggesting a spearphishing attachment attack vector.

Heuristics 7

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Win.Trojan.Clicker-4220 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Clicker-4220
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002767.bin` `ce84dafa8898c728d29e86555dd2fb31ebbc7b9f25d6789fbe2434001624ad4a`	rtf-objdata-decoded	RTF \objdata at offset 0x2767	33584 bytes
Detection ClamAV: Win.Trojan.Clicker-4220 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.