RTF malware analysis — malicious · 20710e28fefe2988

MALICIOUS

RTF

18.3 KB First seen: 2019-04-17

MD5: 0912d4b63eadbeed3709daaa3b52b088 SHA-1: 387771141a0798d5918aea0d07e4267ce24dd99a SHA-256: 20710e28fefe298883c5bb2ed5bdaa80f7ee8e935008d1e87ba11b2fb40acaa5

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and triggers an \objupdate event, indicating exploitation of a vulnerability to execute embedded code. The presence of RTF_OLE10NATIVE_STREAM further confirms the embedded OLE object. While no specific payload or URL is directly visible, the technique strongly suggests the file is designed to download and execute a secondary stage, characteristic of a malicious attachment.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000cd7.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xCD7	5168 bytes
SHA-256: `de66d12d4860a0e35dbb0cd839655d1ac268fa093e43ea249e62d41a39a2df1a`

Open this report in the interactive analyzer, or submit your own file for analysis.