RTF malware analysis — malicious · a407ddd004b28a05

MALICIOUS

RTF

1.08 MB Created: 2018-06-19 11:09:00 First seen: 2021-02-23

MD5: 54e26710be2c36c495584e29a527fd60 SHA-1: 6a1c9d2ac2d0a5a9a1d03a6dc289df284f60b637 SHA-256: a407ddd004b28a058661acef89e83b775d86286fcae935a925c85ebb48462422

282 Risk Score

Heuristics 7

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Generic-6834349-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Generic-6834349-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1005KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 10 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003da4.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3DA4	35899 bytes
SHA-256: `b89ca397bc9757406e0bc3a15a88acb9b14975b0e159cedc37a30752775547c3`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_01_off0001aedc.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1AEDC	35899 bytes
SHA-256: `535e8827dc065fa913578c7dc80708bc87210d19c2ef6bd91b5eec6182d41c31`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_02_off00032014.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x32014	35899 bytes
SHA-256: `6b48b43e1c3dced51bf9eee208fb3990aa9cdca10ff9a1defe167bcfe69d7679`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_03_off0004914c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4914C	35899 bytes
SHA-256: `7e944d23d371ec8ffdcc4cb35463d5e4b058e77c3ce32d90d47eea6004e172f7`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_04_off00060284.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x60284	35899 bytes
SHA-256: `2d47b6ac114d3403e43a37ca96ab65db5972b3920a850191d22db605bca808e6`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_05_off0008ab25.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x8AB25	35899 bytes
SHA-256: `e719e608f9267600ff236a891f741202e420d15fcc2c15de229a967e001c5cae`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_06_off000a1b76.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xA1B76	35899 bytes
SHA-256: `690a4014c63b7a59ed10ef3abb44fd61241117f9728bf6708bb5c7c940c679cc`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_07_off000b8cce.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xB8CCE	35899 bytes
SHA-256: `4e5eb54bf3935030fc0c9fbd9eecabde36891a248866e858f493e22db3e5ef3c`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_08_off000cfe26.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xCFE26	35899 bytes
SHA-256: `b2c99feb98be71951b3c359b629aee3f665c0bcf5e0f89b4e5c1003e67e4e694`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_09_off000e6f7e.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xE6F7E	35899 bytes
SHA-256: `091ffa14036a6047aa8e4903dc976c6c34f4a8882c370a00cc755d5134754449`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.