RTF malware analysis — malicious · b298d98a0925893f

MALICIOUS

RTF

38.6 KB Authoring application: Msftedit 5.41.15.1516 First seen: 2015-10-03

MD5: c90ae361ab421837a9a9281e2f901060 SHA-1: fa4d570535b31eb0f9d754a42df7b4ccb8cb91f2 SHA-256: b298d98a0925893fc66a615c7cec473ab55fc70a5351d9970a27a147f5d750cc

140 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1027 Obfuscated Files or Information

The RTF file contains an embedded OLE object, identified as a package object, which in turn contains a PE header. This strongly suggests the document is designed to trick the user into executing a malicious payload disguised as a receipt. The embedded OLE object is the primary indicator of malicious intent, likely leading to client execution via exploitation.

Heuristics 4

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000e2.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xE2	15226 bytes
SHA-256: `11676435a17be55b2fbe47150d13748b869f124fe2674724c49f9c46b2f11923`

Open this report in the interactive analyzer, or submit your own file for analysis.