RTF malware analysis — malicious · 140d200a1c687c90

MALICIOUS

RTF

22.5 KB First seen: 2026-01-30

MD5: 797349df36221f8a6a82ae195a16ec06 SHA-1: bd39e06eb6e4ca119fb7aa89edee5202d883a221 SHA-256: 140d200a1c687c90ab65342d2baa61799213f7e285836da730a729aadcf4fe88

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and triggers automatic linking and updates, indicating an attempt to execute embedded content. This behavior is consistent with exploiting OLE vulnerabilities to achieve arbitrary code execution. While no specific payload or URL was directly extracted, the high heuristic scores for OLE object manipulation strongly suggest a malicious intent to download and run a secondary stage.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000f39.bin` `3b0a6127e26fa25e6604fda6a7894b2a22ff1207c7ae8a779a8d79ac66e0cb0a`	rtf-objdata-decoded	RTF \objdata at offset 0xF39	4182 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.