RTF malware analysis — malicious · aed64804a5191a6c

MALICIOUS

RTF

406.4 KB Created: 2017-11-02 23:56:00 First seen: 2021-02-23

MD5: 808b2b001b985185164080592d5cd070 SHA-1: 5cbf8a8268f4f8ca0b26ea709237ae794ff2f32f SHA-256: aed64804a5191a6c119cba1f81ad5f09260bac0f8642d1f0101da73e8a7b3329

162 Risk Score

Heuristics 4

ClamAV: Doc.Macro.Obfuscation-6391394-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Macro.Obfuscation-6391394-0
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000298b.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x298B	20545 bytes
SHA-256: `5493d781530d8e51fe80449bf85b2bfd3de180e2285adf7bd6d52dc83e75afde`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_01_off00012144.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x12144	20545 bytes
SHA-256: `6439ca575bab446b6ab1ac3fcc4fd1050ad52c4a932327e03cd2017d2a4b24fa`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_02_off000218fd.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x218FD	20545 bytes
SHA-256: `9813324ae5da25e8faf5d603e00ab274e1d1d26947608b66876ff922f0aaa5be`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_03_off00041190.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x41190	20545 bytes
SHA-256: `92b90ab2aa577175c13940fc7840dd801e5c1b65423079ed3ba6eb4fc870a2fc`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.