RTF / .DOC malware analysis — malicious · 5f568297fb2cc13e

MALICIOUS

RTF / .DOC

2.05 MB First seen: 2022-04-08

MD5: f34f1457ac2e3a7ed1eecbc5b88768eb SHA-1: e9d5049c1faf2a7857e6c22b48a7af4340379c48 SHA-256: 5f568297fb2cc13e296a8fce6ab46e0b0c360cba41132d0ddba1508a61953b0d

360 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information T1204.002 Malicious File

The RTF document contains multiple OLE objects, with one significantly large object containing hex-encoded data that includes a PE header. This structure, combined with the 'Decrypt the document by Enable Editing DP' lure, strongly suggests the document is designed to drop and execute a payload. ClamAV detections indicate the embedded artifact is packed malware, likely Bladabindi.

Heuristics 9

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Rtf.Dropper.Agent-9965975-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.Agent-9965975-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~2079KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000021b.bin` `3fea54b429a5e5914276387f21675412b9a2afda5b01d838dbd09fe90decd884`	rtf-objdata-decoded	RTF \objdata at offset 0x21B	1039745 bytes
Detection ClamAV: Win.Packed.Bladabindi-10017208-0 Obfuscation or payload: unlikely
`objdata_01_off001fbd70.bin` `c45ba56ef1e520c0839063477a0bbc130147492b329b910107ccdc9fe0f361f7`	rtf-objdata-decoded	RTF \objdata at offset 0x1FBD70	29561 bytes
`objdata_02_off0020aaee.bin` `ec53aedbaabf3151b202b3fe0dee656c68fcacde807e6cc3e964f68367d56d1d`	rtf-objdata-decoded	RTF \objdata at offset 0x20AAEE	1731 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.