RTF malware analysis — malicious · 9fc156450b6f9ccb

MALICIOUS

RTF

112.3 KB Created: 2010-08-02 08:50:00 Authoring application: Microsoft Word 11.0.0000

MD5: 23cd2dc5524daef1e560d6257951694a SHA-1: 6e8d57a32b5e14999fda899ab4e90c17ebdb8e4c SHA-256: 9fc156450b6f9ccbe1acd308e7003b050c2ac2c5d646e1744c5aa16150752c01

300 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The RTF document contains an embedded OLE object with a PE header, strongly suggesting it's a dropper for a malicious executable. ClamAV detected the embedded artifact as 'Win.Trojan.Agent-230724'. The presence of OLE object data and a composite moniker further supports the malicious intent of executing an embedded payload.

Heuristics 8

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Win.Trojan.Agent-230724 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Agent-230724
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\gutter0\ltrsect

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000101b.bin` `205eaf6e0c2453f2f83a745042ef79553f798b5af621eabb2286e0ab57eb78d1`	rtf-objdata-decoded	RTF \objdata at offset 0x101B	50974 bytes
Detection ClamAV: Win.Trojan.Agent-230724 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.