Benign Download

Credits.rtf

RTF field target is a remote URLEncoded payload detected: xor
SHA-256f8f2d03ddc2abf6bbdb3733459e8304c85817be3ab1b8c8cf9b80277b71ad2b7
MaleculeMd₂(Pd)

Evidence

Encoded payload detected: xor lines 32–34
32\f4\b\fs26 \cf0 Webstr\'e1nka
33\f2\b0 :\cf5 {\field{\*\fldinst{HYPERLINK "http://www.bean-osx.com"}}{\fldrslt \cf6 www.bean-osx.com}}\
34\pard\pardeftab720\fi360\sl288\slmult1\sa300\partightenfactor0

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.