RTF / .DOC malware analysis — malicious · 671ff07eb6fb58b6

MALICIOUS

RTF / .DOC

23.3 KB Authoring application: Msftedit 5.41.15.1515

MD5: 89c4f954aa2dce66a5ab0037f3e7e74f SHA-1: 192b23d73cfee3679399ede1edf8cd7f482ed657 SHA-256: 671ff07eb6fb58b6ae3bb61b6f67ecc5f41c300c1ea2343420b32e25adeae3b1

200 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains embedded OLE objects, including a PE executable identified by ClamAV as Win.Trojan.Clicker-3800. The embedded PE file is likely a second-stage payload. The presence of the PE header in hex data and the embedded executable strongly suggests the file is designed to deliver malware.

Heuristics 5

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000cf.bin` `121d759219bea7f2f353ab56c4b7fc2c921d8d3f5e6e6921b217e27cafc1d10f`	rtf-objdata-decoded	RTF \objdata at offset 0xCF	11532 bytes
Detection ClamAV: Win.Trojan.Clicker-3800 Obfuscation or payload: unlikely
`embedded_rtf_000001ee.exe` `7685e0f90c7b410370d32c43d52cc0b1c83460f2b79e9f3d14f401328172fce1`	embedded-pe	RTF hex-encoded MZ at offset 0x1EE	11399 bytes
Detection ClamAV: Win.Trojan.Clicker-3800 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.