RTF malware analysis — malicious · ad8a3a4f50ca6419

MALICIOUS

RTF

147.0 KB Authoring application: Msftedit 5.41.21.2509

MD5: ce466cdad5630ab875dfc670598035c9 SHA-1: 89bf7684c6b4dbe23ae293559d76cb64827cc212 SHA-256: ad8a3a4f50ca64190ac1c57dd7faa63df332e6c17a958e5dfe59700b29004670

140 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The RTF file contains embedded OLE object data, specifically identified as a package object. Critical heuristics indicate the presence of a PE header within this data, strongly suggesting that the RTF is acting as a container for a malicious executable. This executable is likely intended to be dropped and run by the user or the application opening the RTF.

Heuristics 4

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000124.bin` `1763982cdb213e792004ecc3ab3fff81eb46f8d067a56f33cf0ff073de82e899`	rtf-objdata-decoded	RTF \objdata at offset 0x124	69475 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.