RTF malware analysis — malicious · 43db675cd79ece50

MALICIOUS

RTF

522.6 KB Authoring application: Msftedit 5.41.15.1507

MD5: c8adc2997fcb252d72fac82beca63dfb SHA-1: 91edb828b9aba7a1610cb84f85517e9883bce76a SHA-256: 43db675cd79ece50cd5d055d7ff8c4f688b8bfe514be3fcbd0ff6a3ee5ba0962

142 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The RTF document contains embedded OLE object data, specifically identified as a Package object class. Within this data, a PE header (DOS stub) was detected in hex data, indicating the presence of a potentially executable artifact. This artifact, named 'objdata_00_off000000d1.bin', is the primary indicator of malicious intent.

Heuristics 5

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000d1.bin` `af1c11626aff84444eb1e9f56aa1a0decfd1f27cfbb53810ec1a82f1c5fab4a8`	rtf-objdata-decoded	RTF \objdata at offset 0xD1	260470 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.98, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.