RTF / .DOC malware analysis — malicious · 4fbfa717a426d3b2

MALICIOUS

RTF / .DOC

2.05 MB

MD5: 86228e167dc12cebfff12adff2fdf0be SHA-1: cbe6518eb9d06ff1ff0113c607c0cb48729388f3 SHA-256: 4fbfa717a426d3b24c41293c94c79734841b174b45777ab67c14b3037bb999dd

360 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information

The RTF document contains multiple OLE objects, with one object featuring a significant amount of hex-encoded data that includes a PE header. This strongly suggests the document is designed to embed and deliver a secondary executable payload. The 'SE_ENABLE_LURE' heuristic indicates the document prompts the user to 'Enable Editing', a common social engineering tactic to bypass security measures and execute embedded content. ClamAV detections further confirm the malicious nature, identifying it as a dropper and detecting an embedded packed executable.

Heuristics 9

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Rtf.Dropper.Agent-9965975-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.Agent-9965975-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~2079KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000021b.bin` `513ccf8aad73a79aa7d04e9b1cac3021cbf47b8b2a57ac14725853513165d34b`	rtf-objdata-decoded	RTF \objdata at offset 0x21B	1039745 bytes
Detection ClamAV: Win.Packed.Bladabindi-10017208-0 Obfuscation or payload: unlikely
`objdata_01_off001fbd70.bin` `c45ba56ef1e520c0839063477a0bbc130147492b329b910107ccdc9fe0f361f7`	rtf-objdata-decoded	RTF \objdata at offset 0x1FBD70	29561 bytes
`objdata_02_off0020aaee.bin` `ec53aedbaabf3151b202b3fe0dee656c68fcacde807e6cc3e964f68367d56d1d`	rtf-objdata-decoded	RTF \objdata at offset 0x20AAEE	1731 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.