Win.Trojan.Zbot-9756764-0 RTF malware analysis — malicious · 6bdc11981124f386

MALICIOUS

RTF

49.1 KB Authoring application: Msftedit 5.41.15.1516 First seen: 2015-10-03

MD5: c92ccb00ed7f09524f881f8f4a6b0850 SHA-1: 3cdeef51e68a1e783c835f873a10e8a762ed45de SHA-256: 6bdc11981124f38616fe4e39a31635e3c237b0e9ea1babb2bf6966cb1f5f0a97

260 Risk Score

Malware Insights

Win.Trojan.Zbot-9756764-0 · confidence 95%

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1027 Obfuscated Files or Information

The RTF file contains an embedded OLE object, identified as a Package object, which in turn contains a PE header. ClamAV detections indicate this is a Zbot variant, a known banking trojan. The document body prompts the user to click an image to view a receipt, a common social engineering tactic to trick users into executing embedded malicious content.

Heuristics 5

ClamAV: Win.Trojan.Zbot-9756764-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Zbot-9756764-0
PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000dc.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xDC	20461 bytes
SHA-256: `7adc476973a28574ce8524b3619c3069c222b0e7c153b2c9d965a271a9defba4`
Detection ClamAV: Win.Trojan.Zbot-9756764-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.