Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 e7c3d1b85aa7017b…

MALICIOUS

RTF / .DOC

346.8 KB Authoring application: Msftedit 5.41.15.1515
MD5: c9eb9798b8ff4f88b964bdfca68d4106 SHA-1: bed7c15edeeada5a516352cf11572cd191fbd9bd SHA-256: e7c3d1b85aa7017baded1d205cef457d31a8b695af987415848b7fe2f0022948
262 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The RTF document contains embedded OLE objects, including a package object, which is a common technique for delivering malicious payloads. Static analysis detected a PE header within the OLE object data, indicating the presence of an executable. ClamAV signatures confirm the detection of 'Win.Trojan.Shark-8', strongly suggesting this is a malicious dropper.

Heuristics 7

  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • ClamAV: Win.Trojan.Shark-8 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Shark-8
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Package object class high RTF_OBJCLASS_PACKAGE
    OLE Package object — can wrap arbitrary files
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000000d1.bin
bafbde37729903fe39dc9ca2dc625bb5e16b43e848227e010a16fe4960b37129		 rtf-objdata-decoded RTF \objdata at offset 0xD1 172779 bytes
Detection
ClamAV: Win.Trojan.Shark-8
Obfuscation or payload: likely
Carved artifact entropy is 7.79, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.