RTF malware analysis — malicious · 09d7024613a91d4a

MALICIOUS

RTF

8.1 KB First seen: 2018-01-23

MD5: a9d3f7a1acd624de705cf27ec699b6b6 SHA-1: 849bc19708a2058753f8d0e6bddd30d95784df75 SHA-256: 09d7024613a91d4ae59209f7a667e4570e0a31e47b4e2a9bde3482f462682b33

140 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains OLE object data with automatic linking and update directives, strongly indicating an attempt to exploit a vulnerability. The presence of URL Moniker related findings suggests the OLE object is designed to fetch and execute a remote payload, likely leading to client execution. The generic document body text provides no specific lure, but the technical indicators point to a malicious attachment.

Heuristics 4

URL Moniker in RTF OLE object high CVE related RTF_URL_MONIKER_RELATED

RTF contains a URL Moniker GUID in OLE object context, but no decoded remote target was confirmed. Treat as related OLE2Link attack-surface evidence rather than proof of CVE-2017-0199 exploitation.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000063.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x63	3551 bytes
SHA-256: `cc1f9cd5b475230f50c673cd28c6343a3d755b1e8fa708bc31510c61121ece91`

Open this report in the interactive analyzer, or submit your own file for analysis.