Win.Trojan.Agent-36106 — RTF malware analysis

Static analysis result for SHA-256 de1ef5d7274771e3…

MALICIOUS

RTF

81.1 KB Authoring application: Msftedit 5.41.15.1515 First seen: 2015-09-26
MD5: 718b1bba5a81ae105885bfdafb24ed25 SHA-1: 5afca948fb08749a39c7c30e9e24d4066cbfa239 SHA-256: de1ef5d7274771e348794d07222a9aa3562a3e7d17d3adf716ca5a93c539032d
280 Risk Score

Malware Insights

Win.Trojan.Agent-36106 · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that decodes to a PE executable. ClamAV signatures identify this as Win.Trojan.Agent-36106. The presence of the PE header within the RTF object data strongly suggests the file is designed to deliver and execute a secondary malicious payload.

Heuristics 6

  • ClamAV: Win.Trojan.Agent-36106 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-36106
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • Package object class high RTF_OBJCLASS_PACKAGE
    OLE Package object — can wrap arbitrary files
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000013e.bin rtf-objdata-decoded RTF \objdata at offset 0x13E 36553 bytes
SHA-256: d4827818a85b0d5f61945181bd66506fad70894521613d090cbde8f6fe43cd6e
Detection
ClamAV: Win.Trojan.Agent-36106
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_STR_LOADLIBRARY, SC_GETPC_CALL Static shellcode analysis recovered API/import strings: kernel32.dll, wininet.dll, shell32.dll, shlwapi.dll, KERNEL32.DLL, LoadLibraryA

Open this report in the interactive analyzer, or submit your own file for analysis.