RTF malware analysis — malicious · 5a4f3eb0010b6100

MALICIOUS

RTF

1.39 MB Created: 2018-02-02 07:21:00 First seen: 2021-02-23

MD5: 1f9a7d25be7e4a8902b7a13f121099f5 SHA-1: 9ebc5e31b2014579ba1a191fbcc167689487c4f2 SHA-256: 5a4f3eb0010b6100af0c53debc7a91c1429e75265c801359ad7591a4f0b5cf9b

242 Risk Score

Heuristics 6

ClamAV: Doc.Macro.Obfuscation-6391394-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Macro.Obfuscation-6391394-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1066KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 8 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 8

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002c31.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2C31	23611 bytes
SHA-256: `619df28908853f88a4e12e4f8bf5388fbede4cdf65ec47f259bc5e2a47007af7`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_01_off0001405b.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1405B	23611 bytes
SHA-256: `6cf5389b416862c76ef97e866bcae11492d45c2df8674d20b0228a85982359fa`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_02_off000253fa.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x253FA	23611 bytes
SHA-256: `add961724a2d5f6081481f8ec65c5d67cad500be5a11eab0e48261d530034954`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_03_off0003679b.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3679B	23611 bytes
SHA-256: `e29f4f5504a863c4009a6d95fea45161758b987544539ad3d61ceece18866b0f`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_04_off00047b43.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x47B43	23611 bytes
SHA-256: `162e853259a1bc356329e029e0c86db6b159d8321391c83ffcf9cbc1d39c70a4`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_05_off00058ee4.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x58EE4	23611 bytes
SHA-256: `3485964d722d65589aeca2b4c15d169e3df1dfaddb41c1b5d157746bf472b397`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_06_off0006a285.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x6A285	23611 bytes
SHA-256: `a97001c7f74c99bb462d2197e7b873fbb7cea00d835fc7ddbd47c7161b4a4b86`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_07_off0007b626.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x7B626	23611 bytes
SHA-256: `d9917a1637902df7b249b267297062c03a4ea5193d414ff3c2a87ad50c1efc39`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.