Malicious RTF — malware analysis report

Static analysis result for SHA-256 1fa2d445e4009796…

MALICIOUS

RTF

9.2 KB First seen: 2020-08-25
MD5: 21b3a1d549f9e5d5b9968ee8f648ebdb SHA-1: b224ce862e897e4f6938fc4ccee7ac7169832667 SHA-256: 1fa2d445e4009796c4c21d5a729d803fb8fcfce781461b9c29166601924ad792
60 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an RTF document that contains OLE object data and an \objupdate directive, indicating it is designed to exploit OLE activation for code execution. This is a common technique for delivering secondary payloads, often via spearphishing attachments. No specific family could be identified from the available evidence.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000016d8.bin rtf-objdata-decoded RTF \objdata at offset 0x16D8 1553 bytes
SHA-256: b8b72c7018819aaa8b70cd94780386b428628df3311325401385ef45a5914c23

Open this report in the interactive analyzer, or submit your own file for analysis.