Win.Trojan.Junkie-1 RTF malware analysis — malicious · a37c5ef93025192b

MALICIOUS

RTF

87.2 KB Authoring application: Msftedit 5.41.15.1515

MD5: 32f3e5982b0b93f0be1235e7e6eee906 SHA-1: 84d667dccf42bcce02fc0966f5d7c6529dc378e1 SHA-256: a37c5ef93025192b54a46fb3f28aaffdc104efdf755a425039331377b8450f44

200 Risk Score

Malware Insights

Win.Trojan.Junkie-1 · confidence 95%

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is an RTF document containing an embedded OLE object, identified by multiple heuristics including RTF_OBJDATA, RTF_OBJEMB, and RTF_OBJCLASS_PACKAGE. ClamAV signatures confirm the detection as Win.Trojan.Junkie-1. The document body displays a Portuguese message, 'Clique 2 vezes para visualizar o arquivo' (Click twice to view the file), suggesting a social engineering lure to trick the user into interacting with the embedded object, which likely leads to malware execution.

Heuristics 5

ClamAV: Win.Trojan.Junkie-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Junkie-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000d2.bin` `b272dead5173ac1c031e7aca453400c62f278d1ca9b9ad6ecaf81fccd197f5de`	rtf-objdata-decoded	RTF \objdata at offset 0xD2	39638 bytes
Detection ClamAV: Win.Trojan.Junkie-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.