RTF malware analysis — malicious · 17c1353cade0d671

MALICIOUS

RTF

3.8 KB

MD5: bbb35f4e2a99cf267dbab2cc9377b0b0 SHA-1: cb19bcdd5908bc20e6b7469529cbb5c24de33f47 SHA-256: 17c1353cade0d6710e8e512a367b3da2f7fbce4902fe75a8778cb6cff282dabd

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF document contains OLE object data and triggers automatic linking and update events, indicating an attempt to exploit OLE vulnerabilities for code execution. The presence of ".bin" file suggests an embedded object that is likely malicious. The document body contains only numerical strings, providing no contextual information about the lure.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000075.bin` `18026f97789cd45e754da38695a82734caa8f7d96761bb29194be3d64862ecfa`	rtf-objdata-decoded	RTF \objdata at offset 0x75	1644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.