Buzus RTF malware analysis — malicious · ce4066df35a5fa54

MALICIOUS

RTF

73.5 KB Authoring application: Msftedit 5.41.15.1515

MD5: 804e746db9e65bc5fbd0d39b63d4d829 SHA-1: 29984822b5ccea0150ac1ec37b3ea82926a1442a SHA-256: ce4066df35a5fa540483ab89ea0bc5063de54b358d2a3ca7ad6fc41b24e128ba

262 Risk Score

Malware Insights

Buzus · confidence 95%

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1129 Execution through API

The RTF file contains an embedded OLE object which, upon inspection, reveals a PE header within its hex data. ClamAV signatures identify this as Win.Trojan.Buzus-41. The embedded object is likely designed to execute this PE file, which is disguised as a PDF, to initiate the malware's payload. The presence of OLE object data and a PE header within the RTF strongly indicates a malicious delivery mechanism.

Heuristics 7

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Win.Trojan.Buzus-41 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Buzus-41
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000d2.bin` `5fb997aeb9767bd4a9f04e428b10a25b42a65acd87e9531dfb23cd71a25de580`	rtf-objdata-decoded	RTF \objdata at offset 0xD2	33050 bytes
Detection ClamAV: Win.Trojan.Buzus-41 Obfuscation or payload: likely Carved artifact entropy is 7.46, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.