Rtf.Dropper.Agent-5329662-0 RTF malware analysis — malicious · ac7d02465d0b1992

MALICIOUS

RTF

508.0 KB Created: 2013-03-13 17:07:00 First seen: 2019-03-18

MD5: 42fba80f105aa53dfbf50aeba2d73cae SHA-1: a49b135a66afba5713936d4758ca5d40f19b9e71 SHA-256: ac7d02465d0b1992809e16aaae2cd779470a99e0860c4d8a2785d97ce988667b

102 Risk Score

Malware Insights

Rtf.Dropper.Agent-5329662-0 · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an RTF document identified by ClamAV as Rtf.Dropper.Agent-5329662-0. Static analysis revealed embedded OLE objects and a shellcode candidate region, strongly suggesting the document is a dropper. The embedded URL, though incomplete, is likely used to fetch a secondary payload. The presence of shellcode and the dropper nature point towards an exploitation for client execution.

Heuristics 4

ClamAV: Rtf.Dropper.Agent-5329662-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.Agent-5329662-0
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft In RTF body

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002f06.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2F06	60541 bytes
SHA-256: `4fb22db406259712ce9cf1876f0e6ccc91920c23a7dd9ceef0cf9bb6b948b432`
`objdata_01_off0003d866.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3D866	20190 bytes
SHA-256: `86423a3bbf5a9428491ab60f2468b41ef7703c4ac16ff5ffb0e098b67494a3e8`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS

Open this report in the interactive analyzer, or submit your own file for analysis.