RTF malware analysis — malicious · cbc27c7cf2525fe9

MALICIOUS

RTF

9.3 KB First seen: 2021-01-23

MD5: 5235585c5b6107c9ca47b96dff8cd3ee SHA-1: cdb3fcc07ab3f7c0064b906fbe785e92ecf2fab6 SHA-256: cbc27c7cf2525fe90750be53740fe74f7c5ab544a9f94b4bd68caa8be6e40d01

140 Risk Score

Heuristics 4

Split hex Equation Editor ProgID + OLE object critical CVE likely RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000001c7.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1C7	3628 bytes
SHA-256: `daf155ce15e9222af8ecb328ff18423010d8112aac53b006c8f2d72e38e73007`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): powershell.exe -noexit -windowstyle maximized

Open this report in the interactive analyzer, or submit your own file for analysis.