RTF malware analysis — malicious · 167672c7a1a49d64

MALICIOUS

RTF

10.9 KB First seen: 2023-01-30

MD5: df4eef9a374aceb229494557eecf072d SHA-1: e6e2142d2f3b2dd8266469a6412e60b475ada809 SHA-256: 167672c7a1a49d64f31c797690a987c1d3f3f22fb75a7881a7394a0e1e6a9e4c

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File T1027 Obfuscated Files or Information

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be activated automatically upon opening the document. This points to a likely attack pattern involving the exploitation of OLE vulnerabilities or the delivery of a malicious payload embedded within the object data. No specific family could be identified, and the document body was truncated.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001e52.bin` `9419edc2b2d78a64615e5b40de5bc78de9cf35ff6e4b9165c8e3df5e662fe744`	rtf-objdata-decoded	RTF \objdata at offset 0x1E52	1646 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.