RTF / .1 malware analysis — malicious · fcd5e5224289e2ee

MALICIOUS

RTF / .1

114.0 KB Authoring application: Msftedit 5.41.15.1515

MD5: 2cd34b4adef4e4d9468b313b53faaf8d SHA-1: 74b4d65c65a2b1ce98a9f8efbb2e5071a3eb5bdd SHA-256: fcd5e5224289e2ee4c20a3dedf483241c2e667c5bc21b018aade1d22e4bd020e

140 Risk Score

Malware Insights

MITRE ATT&CK

T1559.002 Component Object Model Hijacking T1204.002 Malicious File

The RTF file contains an embedded OLE object, identified by RTF_OBJDATA, RTF_OBJEMB, and RTF_OBJCLASS_PACKAGE heuristics. Crucially, a PE header (RTF_MZ_HEX) was found within the object's data, indicating it is likely a Windows executable. This suggests the RTF is a dropper or container for a malicious executable payload.

Heuristics 4

PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000c3.bin` `c8d6a89707846af1a3760278c444cdc042df8b88ef814d264fe80f5d6dff783e`	rtf-objdata-decoded	RTF \objdata at offset 0xC3	53038 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.