Malicious RTF — malware analysis report

Static analysis result for SHA-256 b42d2c70bc4a0827…

MALICIOUS

RTF

828.9 KB Created: 2018-03-07 05:02:00 First seen: 2021-02-23
MD5: c6b03dc7e5e4910302718964f67794d8 SHA-1: 80b4da480ec6a6e3c53e1eff15c290411a7b14e2 SHA-256: b42d2c70bc4a08274921320c608cd9624a740e245b63ab5b39d158c7abc106da
202 Risk Score

Heuristics 5

  • ClamAV: Xls.Downloader.Generic-6750544-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Generic-6750544-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002c3c.bin rtf-objdata-decoded RTF \objdata at offset 0x2C3C 27707 bytes
SHA-256: 8d1bd2776eab107bfe635b8382678d5d077b4edf7d790f718a0552f972b37088
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_01_off0001677f.bin rtf-objdata-decoded RTF \objdata at offset 0x1677F 27707 bytes
SHA-256: ed53e0acca6f5a4e1940607eecfc80d77ba06d36b4689413e6204ad778e76a5d
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_02_off0002a2c2.bin rtf-objdata-decoded RTF \objdata at offset 0x2A2C2 27707 bytes
SHA-256: 4088ee11beb7908015a9dbb03521704d10cea772cbfd3b920f51f07c6ca429fc
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_03_off0003de05.bin rtf-objdata-decoded RTF \objdata at offset 0x3DE05 27707 bytes
SHA-256: fd3c5cbda8c3eb4363530da2326702d00a95758379188272a257968126f97d5e
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_04_off00051948.bin rtf-objdata-decoded RTF \objdata at offset 0x51948 27707 bytes
SHA-256: efbdd1d1cc2d0b780dd76ef0afed16cd3e654217da39c931ac21494439122896
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_05_off000654d5.bin rtf-objdata-decoded RTF \objdata at offset 0x654D5 27707 bytes
SHA-256: c0329990f6ff6de2c0ff0130832dc129e6e44f1b9c242b047a6c4e143d164a9b
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_06_off00079018.bin rtf-objdata-decoded RTF \objdata at offset 0x79018 27707 bytes
SHA-256: 5208141433a806443ec82ba85e7fbac1f4d181e24b4e34cb9c9589b7d4016f77
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_07_off0008cb5b.bin rtf-objdata-decoded RTF \objdata at offset 0x8CB5B 27707 bytes
SHA-256: 86cf83d45ea803693bb77bcbb8a63a1fb01149e21987bd1093f9337015b0291b
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_08_off000a069e.bin rtf-objdata-decoded RTF \objdata at offset 0xA069E 27707 bytes
SHA-256: 710723f25e6a1e9d81d3f85024f46cf5e0efd347dc47629b86861ea6e0f5365f
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_09_off000b41e1.bin rtf-objdata-decoded RTF \objdata at offset 0xB41E1 27707 bytes
SHA-256: 792696ea62fb9394d1c8a874f06241c680633241a888d32cedbdf401cfadd7d1
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.