RTF malware analysis — malicious · 0aa5d51a8b549334

MALICIOUS

RTF

8.8 KB First seen: 2020-08-10

MD5: 19d0e01322f85699fe2f53b55e3e115c SHA-1: a22a7aa8717464dad1584e4e754024bf786e5fef SHA-256: 0aa5d51a8b5493345c6b1b78416c49e9170accd1a7ab1bc5a9ef0fef199dd1a2

80 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be activated, likely to exploit a client-side vulnerability for execution. The extracted artifact 'objdata_00_off000013cf.bin' is flagged as a potential shellcode candidate, further supporting the exploitation attempt. The exact nature of the payload or exploit is not clear from the static analysis, but the overall pattern suggests a downloader or dropper.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000013cf.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x13CF	1803 bytes
SHA-256: `3686561e40d28a929f91e884b60f5c8fa38046b8786db4558630b51dbd0613fb`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL

Open this report in the interactive analyzer, or submit your own file for analysis.