RTF / .VRS malware analysis — malicious · 61fcab5ca606c9e3

MALICIOUS

RTF / .VRS

106.9 KB Authoring application: Msftedit 5.41.15.1515

MD5: ec4f70a0985c1f13a5e4a2c625d1c68b SHA-1: 1783977326eb947bf32b7e70a48478358fe40cdc SHA-256: 61fcab5ca606c9e3a0be3974afa1d0308d93f0461c97f3d053f3b4cbe17d9159

260 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object which is identified as a PE executable by ClamAV. This suggests the file is a dropper or a container for a malicious payload. The presence of the PE header in hex data and the ClamAV detection strongly indicate malicious intent.

Heuristics 6

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Win.Trojan.3879934-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.3879934-2
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000cf.bin` `8a34632540be804bef377af596cd444f27ace11049094a58f562518aae08a39b`	rtf-objdata-decoded	RTF \objdata at offset 0xCF	49469 bytes
Detection ClamAV: Win.Trojan.3879934-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.