Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 0303df63ff8d94fa…

MALICIOUS

RTF / .DOC

3.1 KB First seen: 2023-08-04
MD5: 98154a62f5e9ea0dfb7bb319c80e9d8d SHA-1: 032d3d8a324995deedd3f075692591d96de40157 SHA-256: 0303df63ff8d94fae617ae7a9f2611d51e4f0ec18d4f46b2add504656d231c7b
80 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE objects, with heuristics indicating that \objupdate forces OLE activation. This suggests the document is designed to exploit a vulnerability, likely to execute embedded code or download a secondary payload. No specific family could be identified from the available evidence.

Heuristics 3

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000008a.bin
4df2f24607a6f793a7810f6556f60979e219cb5195d06433e46ae269d9613e91
rtf-objdata-decoded RTF \objdata at offset 0x8A 1494 bytes