MALICIOUS
60
Risk Score
Malware Insights
MITRE ATT&CK
T1204.002 Malicious File: Malicious File
The file is an RTF document containing embedded PHP code. The PHP code attempts to execute system commands using functions such as exec and shell_exec, and checks for 'uid' or 'Windows' to determine server security status. This indicates an attempt to exploit server-side vulnerabilities for command execution. The presence of a PHP shell script suggests a web shell delivery or exploitation attempt.
Heuristics 1
-
ClamAV: Win.Trojan.ShellExec-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.ShellExec-1
Open this report in the interactive analyzer, or submit your own file for analysis.