RTF malware analysis — malicious · bbae602588aa9b96

MALICIOUS

RTF

5.86 MB Authoring application: Msftedit 5.41.15.1507

MD5: fc10477285c1d739cc838f85f9dea72f SHA-1: fec9db2bbc2f802b5e13677c82bd639a594a3da9 SHA-256: bbae602588aa9b96f4d9b4ec2a3243630e8b4cab4d55c45c0a826cc1f2b0b2ab

220 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model T1204.002 Malicious File

The RTF file contains a large amount of hex-encoded data within an OLE object, which includes a PE header. This strongly indicates the presence of an embedded executable. The 'RTF_MZ_HEX' and 'RTF_EXCESSIVE_HEX' heuristics confirm the suspicious nature of the embedded data, likely intended to be extracted and executed by the user or a subsequent process.

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~4173KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000d3.bin` `4d93a229ab4b3a7a3022a43e591a288b9ea5dd0c153af39b15cd9e60c4953697`	rtf-objdata-decoded	RTF \objdata at offset 0xD3	2034378 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.