RTF malware analysis — malicious · 126ac366d10bebba

MALICIOUS

RTF

17.9 KB First seen: 2019-02-26

MD5: c4636b9883df2591d92cdbd210069259 SHA-1: 31f4d1fe968c8586b700d2581d3d5f82fdae4517 SHA-256: 126ac366d10bebba6311224afbf02b68c125682a0836905986b773b6371191c3

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains an embedded OLE object with objdata and objupdate directives, indicating an attempt to exploit a client-side vulnerability. The high entropy of the decoded OLE object suggests it likely contains shellcode or a payload. While no specific family is identified, the technique strongly suggests exploitation for client execution, likely delivered via spearphishing.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000010f1.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x10F1	4652 bytes
SHA-256: `fd222546869176502845aa83d17fb3097c87221a9bb6d20989d9d4aeca95ab1b`

Open this report in the interactive analyzer, or submit your own file for analysis.