Rtf.Dropper.Agent-7207394-0 — RTF malware analysis

Static analysis result for SHA-256 96daacb244f2a4a6…

MALICIOUS

RTF

773.6 KB Created: 2019-09-17 13:59:00 First seen: 2020-05-25
MD5: 9c2d27308583f56a3ac367c0c2d6e28e SHA-1: 7642df2f160a284888cae8bc719deebd221639a1 SHA-256: 96daacb244f2a4a6735900db589afbe32d6f11fba49a2d95268f5affb53170c4
142 Risk Score

Malware Insights

Rtf.Dropper.Agent-7207394-0 · confidence 90%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is an RTF document containing embedded OLE objects, with heuristics indicating OLE object data and activation. ClamAV identifies it as Rtf.Dropper.Agent-7207394-0, suggesting it acts as a dropper for further malicious payloads. The embedded URL, though benign, is present within the RTF body, and the overall structure points to exploitation of OLE object handling for execution.

Heuristics 5

  • ClamAV: Rtf.Dropper.Agent-7207394-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-7207394-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00097f1f.bin rtf-objdata-decoded RTF \objdata at offset 0x97F1F 33573 bytes
SHA-256: 448716e306226fb96b7c2d9bba6ecd55c17903a3da7e2f1fb0490356da7dd07d

Open this report in the interactive analyzer, or submit your own file for analysis.