RTF malware analysis — malicious · e5245b3b82baddb2

MALICIOUS

RTF

141.1 KB Authoring application: Msftedit 5.41.15.1515

MD5: 6957e402a73341cd9f3e524409f56b29 SHA-1: cb455b432f09203ee774c508d6afef6662ab9e5e SHA-256: e5245b3b82baddb2d4d14dcd0a3cf239a59624d6db44f8b6132d38544e8a3913

140 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The RTF document contains embedded OLE objects, one of which has a PE header. This strongly suggests the RTF is a container for a malicious executable. The presence of RTF_OBJDATA, RTF_OBJEMB, and RTF_OBJCLASS_PACKAGE heuristics further supports the embedding of executable content. No document body or scripts were extracted, but the structure points to a malicious payload.

Heuristics 4

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000df.bin` `091cc14d36e97be7d3ddd981802b0f5842a8f7e3b67fc300d53fa725238e1d8f`	rtf-objdata-decoded	RTF \objdata at offset 0xDF	70033 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.