#rtfobj

Interesting malware: #rtf file contains Excel.SheetMacroEnabled.12 objs (#ole). 1st obj contains a package stream which is in #xlsx format. The xlsx file contains #vba macro which runs #powershell to download #vba macro. #vba dls two bin files #opendir

@decalage2 I tried #rtfobj but it couldn't extract the ole objects.

Sample for targeting #Vietnam?? MD5: 1e9f1746c2dbea0df5017afdf8b94189 Name: "Thông cáo báo chí Kỳ họp thứ nhất của Ủy ban Kiểm tra Trung ương khóa XIII.docx"

@kienbigmummy yes

@Ledtech3 You can use #rtfobj with option -s sir.