RTF malware analysis — malicious · 06b439539652aeec

MALICIOUS

RTF

24.6 KB First seen: 2023-06-05

MD5: a411c5f01d2a3c00973839711c3ab747 SHA-1: 24b5f0c0aa6c680f53b455ac642543ada941f0cf SHA-256: 06b439539652aeec2b097c39ac61660e746b5961a0f8110035fbc8237d4eff8c

80 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE objects, as indicated by the RTF_OBJDATA and RTF_OBJEMB heuristics. The RTF_OBJUPDATE heuristic suggests that these objects are designed to be activated automatically, which is a common technique for exploiting vulnerabilities or delivering malicious payloads. The specific exploit or payload is not detailed in the provided evidence, leading to an unknown family classification.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000199c.bin` `3708b8a64e975fae6feccdf82377e9503fdca8e31a264b0adece0ecf47886df8`	rtf-objdata-decoded	RTF \objdata at offset 0x199C	3670 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.