Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 21d86f21cd024589…

MALICIOUS

RTF / .DOC

116.7 KB
MD5: 23886efb34e216c268008573c3c690c1 SHA-1: 685515cdf13abfdfd39cd92e84acb811d2dd9da9 SHA-256: 21d86f21cd024589b36634ee4d148100434a8b2afb76e897c34778864c029f24
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and an \objupdate directive, indicating it's designed to exploit vulnerabilities related to OLE object activation. The high-severity RTF_OBJUPDATE heuristic suggests that the embedded object is automatically activated upon opening the document. This mechanism is commonly used to download and execute further malicious content. No specific family could be identified from the available evidence.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000084e.bin
300dddd04f544ec17f4ad856dbf1393230a8b3477064668e13320851d322dc50
rtf-objdata-decoded RTF \objdata at offset 0x84E 2013 bytes