Malicious RTF — malware analysis report

Static analysis result for SHA-256 e84ebc631097ce15…

MALICIOUS

RTF

125.9 KB Created: 2021-05-13 02:23:00
MD5: 9fae1aa8db790fac114359c34425a727 SHA-1: ccc402845b46285d04d1d45db964f3c1a0df51d5 SHA-256: e84ebc631097ce15d13619b704d140da2398f7b1502be388f5081ebe66c6aedf
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The RTF file contains a remote template injection heuristic pointing to http://designerzebra.com/services/check1, indicating an attempt to download a payload. The document body includes a lure to 'Enable Editing', a common tactic to bypass macro security. The embedded URL is likely used to fetch and execute a second-stage malicious script.

Heuristics 3

  • Remote template injection (\*\template → remote URL) critical CVE related RTF_REMOTE_TEMPLATE
    The RTF's \*\template destination is a remote URL/UNC path. When Word opens the document it fetches and loads that template, which can carry macros or an exploit, deliver a scriptlet/HTA, or leak NTLM credentials over UNC. Benign documents attach only a local template, so a remote \*\template target is template-injection delivery (MITRE T1221). remote \*\template target (Word fetches it on open); destination obfuscated with \uN/\'xx escapes.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://designerzebra.com/services/check1
    • http://schemas.microsoft.com/office/word/2003/wordml

Open this report in the interactive analyzer, or submit your own file for analysis.