Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 06a04458af6fec86…

MALICIOUS

RTF / .DOC

75.3 KB
MD5: 30ad718d3e930ce300bd86132c401be9 SHA-1: ce1c1bd6aa886947ac1a152920e47ab477f1e920 SHA-256: 06a04458af6fec86d9ad331be921d91587c503f5b4f8b55af43e452f47824613
80 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF document contains embedded OLE objects, indicated by RTF_OBJDATA and RTF_OBJEMB heuristics. The RTF_OBJUPDATE heuristic suggests that these objects are configured to activate automatically upon opening, which is a common technique for executing embedded malicious code. The file is classified as malicious with a high risk score.

Heuristics 3

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000c6a.bin
7887cf0659542bfe02a54092e8ddf8250019a7c3c8b6dbd60ee5087b5b483176
rtf-objdata-decoded RTF \objdata at offset 0xC6A 4253 bytes