RTF malware analysis — malicious · e6c2583b65b79210

MALICIOUS

RTF

1.61 MB Authoring application: Msftedit 5.41.15.1515

MD5: 65e326e60af9bf389ea9cd44e3e1a2d8 SHA-1: 7810ecd6eb60c70c9ad275e9fd56223f5eb4e78a SHA-256: e6c2583b65b792105a4b8657547c298f10c06b7f7791326163e7d7893c8bc709

180 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model T1137.001 DLL Search Order Hijacking

The RTF file contains multiple indicators of malicious OLE objects, including RTF_OBJDATA, RTF_OBJEMB, and RTF_OBJCLASS_PACKAGE. A significant portion of the file is hex-encoded data within an OLE object, which the RTF_MZ_HEX heuristic identifies as containing a PE header. This strongly suggests the RTF is a dropper for a malicious executable. No scripts were extracted from this sample.

Heuristics 5

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1676KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000010c.bin` `05624a3367c0d16f43552a88155fe7bed402721ac532340f9d04e574c1b06662`	rtf-objdata-decoded	RTF \objdata at offset 0x10C	817086 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.