RTF malware analysis — malicious · fd9bdd96b1e82e08

MALICIOUS

RTF

339.2 KB

MD5: 77f1129f9b0b0278d36062ad85fc6f42 SHA-1: 01c1dccd105aa5bd9144e9c849c95c0ba79c8b98 SHA-256: fd9bdd96b1e82e08a1a15288a30de9e17779211cf6845ea284655fee90148e11

162 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The file is an RTF document exhibiting high-confidence indicators of maliciousness, specifically the embedding and automatic updating of OLE objects. ClamAV identifies it as Rtf.Dropper.Agent-7652589-0, suggesting its primary function is to act as a dropper. The presence of OLE object data and automatic linking points towards an attempt to execute embedded or linked content, likely a second-stage payload. No document body text or scripts were extracted, limiting further analysis of the specific lure or payload mechanism.

Heuristics 5

ClamAV: Rtf.Dropper.Agent-7652589-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.Agent-7652589-0
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001ee8.bin` `766c474b658eaa5ae834697a03286ee5e8f5f5f9a13fdc7d992aa5d963e31d9a`	rtf-objdata-decoded	RTF \objdata at offset 0x1EE8	169712 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.