RTF malware analysis — malicious · 08c01681e8ff89e3

MALICIOUS

RTF

20.5 KB

MD5: 4e84044d53a87d7e839374d7cade49cc SHA-1: 7a1b45ff36797c9607c3dd75d1c73830925dde6a SHA-256: 08c01681e8ff89e3bf3f3d3dda76c0a026607f7f4cc3ec8dfbe77ec4c9a45ee3

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains OLE objects with embedded data, triggered by \objupdate directives. This indicates an attempt to exploit OLE activation mechanisms to execute arbitrary code. The specific attack pattern is likely spearphishing attachment, leading to client execution via OLE exploitation. No document body or script content was available for further analysis.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000600.bin` `83cfbc29636cd64bcc0b33e23f17614c5e346723d7568efa49b3b4a596b22b79`	rtf-objdata-decoded	RTF \objdata at offset 0x600	4196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.