RTF malware analysis — malicious · 50539deb509814d4

MALICIOUS

RTF

561.7 KB Created: 2016-04-11 12:28:00 First seen: 2020-12-25

MD5: bc7d13043fd9cdc65b5e70b1662f40d3 SHA-1: 76053b58643d0630b39d8c9d3080d7db5d017020 SHA-256: 50539deb509814d4f5c5fe98aedb6f49d5b2f4c495e5e086dac8556c2e47b8e8

104 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample is identified as malicious by ClamAV, specifically detecting an exploit for CVE-2016-7193 within the RTF document. This indicates the file is designed to leverage a known vulnerability to achieve code execution on the victim's system. The presence of OLE object data further supports the exploitation vector.

Heuristics 5

ClamAV: Rtf.Exploit.CVE_2016_7193-6335728-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2016_7193-6335728-0
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000028f7.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x28F7	264241 bytes
SHA-256: `983596cea583d6fa1d1462949637de94f35c56a00783d5686fa22d92e161d14b`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.97, consistent with packed or encrypted content.
`objdata_01_off0008a134.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x8A134	2612 bytes
SHA-256: `ea52b3af8b791eb0126ba8fecddacf95704471a75bd2906005164dd93d8c0b23`

Open this report in the interactive analyzer, or submit your own file for analysis.