RTF malware analysis — malicious · 180f5a0f9210698b

MALICIOUS

RTF

277.0 KB Created: 2022-11-29 05:56:00 Authoring application: Aspose.Words for .NET 19.11 First seen: 2023-05-30

MD5: 92d994be99ea43c121ac4f4ddfacbf75 SHA-1: f14afd2856dab6183150f6e269f5bb6f4a2e3f50 SHA-256: 180f5a0f9210698b54dcafb9a230b12e3eaf199889e5377a2acb7124c2d48d69

162 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains multiple OLE object data sections and uses \objupdate to force OLE activation, indicating an attempt to exploit vulnerabilities related to OLE object handling. The presence of a heap-spray pattern further suggests code execution. While no specific script was extracted, the structure strongly implies a malicious OLE object designed to deliver a payload.

Heuristics 6

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
Heap-spray pattern detected high SC_HEAP_SPRAY

Repeated 0x41 (A) bytes found
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002b42.bin` `42342a47bfa5f50bec485a077e7f1f1815d5e9259bfea7e534ff79ea269ea4ba`	rtf-objdata-decoded	RTF \objdata at offset 0x2B42	125992 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.96, consistent with packed or encrypted content.
`objdata_01_off00040889.bin` `2b07f5ea804fd07b25fdbf682757b5da9e60f8cdcdebf8b1f1e88a3002ef0ec1`	rtf-objdata-decoded	RTF \objdata at offset 0x40889	8896 bytes
`objdata_02_off000408a3.bin` `8306c966abd5906315a987d26628f813eedea9428abfcdbcbfddfc65f6a19313`	rtf-objdata-decoded	RTF \objdata at offset 0x408A3	8892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.