Malicious RTF — malware analysis report

Heuristics 2

• XOR-encoded strings (key 0xBC) critical SC_XOR_ENCODED
  Found 8 Windows library/API name(s) XOR-encoded with single-byte key 0xBC: 'msvcrt.dll', 'msvcrt.dll', 'LoadLibraryA', 'GetProcAddress', 'CreateProcessA', 'CreateFileA', 'CreateFileA', 'CreateFileA'
  Disassembly hidden — these bytes score as data, not coherent x86 code (no internal branches to corroborate control flow).
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/drawingml/2006/main In RTF body

Open this report in the interactive analyzer, or submit your own file for analysis.