RTF malware analysis — malicious · 098cb30970dd2fc4

MALICIOUS

RTF

3.3 KB First seen: 2023-01-16

MD5: 815bb902aa778ff788f22db14b0053f3 SHA-1: fa03f2a12a3dfcb0661fc15d2bc7944f82b75fce SHA-256: 098cb30970dd2fc4982ffb4fad8e80ec615e677cf2756c5256c360b2c9f7f199

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data and uses an \objupdate directive, indicating an attempt to exploit a vulnerability to activate and execute the embedded object. This is a common technique for delivering malicious payloads. The specific exploit targeted is not detailed, but the mechanism suggests a malicious attachment designed to compromise the user's system upon opening.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000006f.bin` `9733c2096801a3b4e086357b57be1157dbe43bb80ae88dcdd0bf1d095d696f7b`	rtf-objdata-decoded	RTF \objdata at offset 0x6F	1601 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.