RTF malware analysis — malicious · 45375147fb874e8c

MALICIOUS

RTF

1.7 KB Authoring application: Riched20 10.0.19041 First seen: 2026-06-28

MD5: ff13a2ac5b7ee56e3a5b66b8b0ff684f SHA-1: cb0bd01592a2f93ab4f157f1cca621a7371ac4fa SHA-256: 45375147fb874e8c1bae1c0e1f4d921c59769225b080e39c9e2ce300f8c597c9

122 Risk Score

Heuristics 4

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
Reference to certutil (download/decode) high SC_STR_CERTUTIL

Reference to certutil (download/decode)
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://tamado-szerver.com In RTF body

Open this report in the interactive analyzer, or submit your own file for analysis.