Xls.Malware.Valyria-10036093-0 RTF / .DOC malware analysis — malicious · 44153c015da5aeb8

MALICIOUS

RTF / .DOC

1.04 MB Created: 2021-03-31 23:41:00

MD5: 73e183aacd897cf94d2cfbdfd1c760ce SHA-1: 246e9725387abd343b7b27a9aaf24b542919eb90 SHA-256: 44153c015da5aeb82c7f6266da77407d2b4d76f886d53b88f63bee7ed09b930c

240 Risk Score

Malware Insights

Xls.Malware.Valyria-10036093-0 · confidence 95%

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1559.001 Component Object Model Hijacking

The RTF file contains multiple embedded OLE objects, with significant amounts of hex-encoded data within the \objdata sections. The \objupdate directive indicates an attempt to force OLE activation, strongly suggesting the embedded objects are malicious payloads. ClamAV detection of 'Xls.Malware.Valyria-10036093-0' further confirms the malicious nature of the file.

Heuristics 6

ClamAV: Xls.Malware.Valyria-10036093-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Valyria-10036093-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1023KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 8 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00069633.bin` `097ab882679cdf34337415bc5cfa9f6ad1fb242b9ae7c9b2880039cd9a90c17f`	rtf-objdata-decoded	RTF \objdata at offset 0x69633	28731 bytes
Detection ClamAV: Xls.Malware.Valyria-10036093-0 Obfuscation or payload: unlikely
`objdata_01_off0007cd99.bin` `7f37030bedb7a85108baf7d9f9e39e85e873f7bdb52fc12e93505bd02238d363`	rtf-objdata-decoded	RTF \objdata at offset 0x7CD99	28731 bytes
Detection ClamAV: Xls.Malware.Valyria-10036093-0 Obfuscation or payload: unlikely
`objdata_02_off000904fd.bin` `f28ad043359888ce29655daef237ce498999662fb8a29d43e57cdd1ed710810e`	rtf-objdata-decoded	RTF \objdata at offset 0x904FD	28731 bytes
Detection ClamAV: Xls.Malware.Valyria-10036093-0 Obfuscation or payload: unlikely
`objdata_03_off000a3d68.bin` `603e369508b57f0daf4497efeb64a00fb9e04e17a2cea82d5850853f837b84df`	rtf-objdata-decoded	RTF \objdata at offset 0xA3D68	28731 bytes
Detection ClamAV: Xls.Malware.Valyria-10036093-0 Obfuscation or payload: unlikely
`objdata_04_off000b7621.bin` `f92a7ddb6df7c1ad39e6d9b2d0952b99514333ff9f465642726dde117bbcc338`	rtf-objdata-decoded	RTF \objdata at offset 0xB7621	28731 bytes
Detection ClamAV: Xls.Malware.Valyria-10036093-0 Obfuscation or payload: unlikely
`objdata_05_off000cae8e.bin` `8b59864e9ba7e861034f79c833dce0cfe54cd5f07d2cff2a9af53ca8366e2657`	rtf-objdata-decoded	RTF \objdata at offset 0xCAE8E	28731 bytes
Detection ClamAV: Xls.Malware.Valyria-10036093-0 Obfuscation or payload: unlikely
`objdata_06_off000de747.bin` `d0134416ae72d89f16b44844e444c9bec61efbdb2acbf0f8ee5a62adfaa2c41a`	rtf-objdata-decoded	RTF \objdata at offset 0xDE747	28731 bytes
Detection ClamAV: Xls.Malware.Valyria-10036093-0 Obfuscation or payload: unlikely
`objdata_07_off000f1fb4.bin` `1e8bbbe11662aff8030e3753951576106bfd26c9db49f56a6a97463097d42428`	rtf-objdata-decoded	RTF \objdata at offset 0xF1FB4	28731 bytes
Detection ClamAV: Xls.Malware.Valyria-10036093-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.