RTF malware analysis — malicious · 1e6b6f2b94ba22f1

MALICIOUS

RTF

3.6 KB First seen: 2023-10-18

MD5: b22db970aeff8f7b4490d206b850c205 SHA-1: 8d758db65bfe2962a2211c6d9ac90d48efc5a881 SHA-256: 1e6b6f2b94ba22f1fd86fc927e87f1568deb3762590af9d091cd9c02b8390456

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be automatically activated upon opening the document, likely exploiting a vulnerability to execute arbitrary code. This points to a malicious document designed for exploitation.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000008c.bin` `317427233e993f476c014678d0f1e9663fbe129df1b018e7fe4028e0d0906912`	rtf-objdata-decoded	RTF \objdata at offset 0x8C	1729 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.