Win.Trojan.Zbot-9756764-0 RTF malware analysis — malicious · 4e4ac1fb311dc53e

MALICIOUS

RTF

48.4 KB Authoring application: Msftedit 5.41.15.1516 First seen: 2015-09-17

MD5: 3ceff044f48b6fe8aeaf946ff8096850 SHA-1: 34145472cdfad4742d87af9fc99e24adfa925c5e SHA-256: 4e4ac1fb311dc53e5d3fa7ebe28516dbc4a6a7c69cf2a4d53f3a10f4187fe005

260 Risk Score

Malware Insights

Win.Trojan.Zbot-9756764-0 · confidence 95%

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1027 Obfuscated Files or Information

The RTF file contains an embedded OLE object, identified as a Package object, which in turn contains a PE header. ClamAV detections indicate this is a Zbot variant, a known banking trojan. The document body prompts the user to click an image to view a receipt, a common social engineering tactic to trick users into executing embedded malicious content.

Heuristics 5

ClamAV: Win.Trojan.Zbot-9756764-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Zbot-9756764-0
PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000db.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xDB	20461 bytes
SHA-256: `7adc476973a28574ce8524b3619c3069c222b0e7c153b2c9d965a271a9defba4`
Detection ClamAV: Win.Trojan.Zbot-9756764-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.