RTF / .DOC malware analysis — malicious · f0213644212eba06

MALICIOUS

RTF / .DOC

2.05 MB

MD5: 4a305365acbe1cb9d900acce05885abd SHA-1: 0aee4602308040b4efc35ae634d12ec72e7f34de SHA-256: f0213644212eba0669c54c6e0fd1659be4a7b7be17dd3cc1716de69cfcab1561

360 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment

The RTF file contains multiple OLE objects, including one with a PE header hidden within hex-encoded data. The 'SE_ENABLE_LURE' heuristic indicates the document prompts the user to enable editing, a common tactic for malware droppers. ClamAV detections confirm the malicious nature, identifying it as 'Rtf.Dropper.Agent-9965975-1' and an extracted artifact as 'Win.Packed.Bladabindi-10017208-0'. The primary function appears to be dropping a secondary payload.

Heuristics 9

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
ClamAV: Rtf.Dropper.Agent-9965975-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.Agent-9965975-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~2079KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000021b.bin` `4350eb6b5af190c3e4da67b141a20c177620f002658f5a1597efe5483f7bb2b3`	rtf-objdata-decoded	RTF \objdata at offset 0x21B	1039745 bytes
Detection ClamAV: Win.Packed.Bladabindi-10017208-0 Obfuscation or payload: unlikely
`objdata_01_off001fbd70.bin` `c45ba56ef1e520c0839063477a0bbc130147492b329b910107ccdc9fe0f361f7`	rtf-objdata-decoded	RTF \objdata at offset 0x1FBD70	29561 bytes
`objdata_02_off0020aaee.bin` `ec53aedbaabf3151b202b3fe0dee656c68fcacde807e6cc3e964f68367d56d1d`	rtf-objdata-decoded	RTF \objdata at offset 0x20AAEE	1731 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.