Rtf.Dropper.Agent-6978564-0 — RTF malware analysis

Static analysis result for SHA-256 870552c9b47b7e17…

MALICIOUS

RTF

3.2 KB First seen: 2019-05-31
MD5: 3aa17887615870e54dca0ff04ae1c087 SHA-1: 63201512f2fb3393d946259ce2c18ad46a99ab2e SHA-256: 870552c9b47b7e1719c40b06ab716169d32e73eeda7764440d6a2301d6864dd8
120 Risk Score

Malware Insights

Rtf.Dropper.Agent-6978564-0 · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains OLE object data and an \objupdate directive, indicating it is designed to trigger the execution of embedded content upon opening. ClamAV identifies this as Rtf.Dropper.Agent-6978564-0, suggesting it acts as a dropper for further malicious payloads. The embedded OLE object is the primary mechanism for achieving initial execution.

Heuristics 3

  • ClamAV: Rtf.Dropper.Agent-6978564-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-6978564-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000166.bin rtf-objdata-decoded RTF \objdata at offset 0x166 1412 bytes
SHA-256: 91b56927525b43a0a94d5b9ebde8032cff9bc540f80cd85dc91e32e42db59b78

Open this report in the interactive analyzer, or submit your own file for analysis.