RTF malware analysis — malicious · 8b94f1182b23edb3

MALICIOUS

RTF

1.04 MB Created: 2018-06-29 12:24:00 First seen: 2021-02-23

MD5: 459af512b18a6b60156d45bad87e6c9b SHA-1: a21dd91d4d58d98833cf6c2f1566107b0b6acea6 SHA-256: 8b94f1182b23edb382f87de92eb1d2ffa503986fe0b02cb18ab85870f03a576f

284 Risk Score

Heuristics 8

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Generic-6834349-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Generic-6834349-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1008KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 10 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003d76.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3D76	41019 bytes
SHA-256: `275cd4e4b43a298fc1b3a2bb8b6e10efb623064325868ce910bd1f3322665119`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_01_off0001d6c3.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1D6C3	41019 bytes
SHA-256: `9f4dc876432d04f49b3fec73c57223693a2ab3cb96466c99574bfcac7e990329`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_02_off00037010.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x37010	41019 bytes
SHA-256: `7bf6bd0a74c18e36096c9bb3bbe0dd775615180201e5b4a2f234474af287d87f`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_03_off0005095d.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x5095D	41019 bytes
SHA-256: `2188a3a4c437175fcc084a28923c236701d3d3744334e942a78cb666b8c0aa22`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_04_off0006a2aa.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x6A2AA	41019 bytes
SHA-256: `68c53d3e2eb3fc36d52e897e2a9641365a3f13cedfb84110997426f0a1b04139`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_05_off00084a0e.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x84A0E	41019 bytes
SHA-256: `a42a1f404ca1dcb1ad963fe8ab2a3928656c230c7407c9ef464616e4963174b3`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_06_off0009e379.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x9E379	41019 bytes
SHA-256: `201c360a26318eec265277f06626d80d1fa57fdc2d663443f6c7e640a494dcd5`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_07_off000b7ce6.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xB7CE6	41019 bytes
SHA-256: `039e4ce5c8c89f2f81bb71545b2a40bd198a598e8b52baa46293b47fb269720b`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_08_off000d1653.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xD1653	41019 bytes
SHA-256: `b3404cbfdeeb904563ef6afcff25e09d6c020a02a7702e82539cc3331c31aed8`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.
`objdata_09_off000eafc0.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xEAFC0	41019 bytes
SHA-256: `15b8c8b74eca0fcaed8eb5da395227e2ef6b3a7c47dfa932f5ababfcd22df577`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: likely Carved artifact entropy is 7.49, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.