RTF malware analysis — malicious · 22437f7297e5c782

MALICIOUS

RTF

14.2 KB First seen: 2020-02-04

MD5: 9b2ac09692975087185b1c82fe772b06 SHA-1: 524c5b07d8199a02627462187f3c3367df9c0ae2 SHA-256: 22437f7297e5c782d85a5defe8260641f38b429b926f89b88ff006996b152b8b

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF document contains OLE object data that is forced to activate via \objupdate, indicating an attempt to exploit OLE vulnerabilities. The embedded OLE object stream, Ole10Native, has high entropy, suggesting it contains obfuscated or packed code. While no specific scripts were extracted, the heuristics strongly suggest the document is designed to execute arbitrary code upon opening, likely as a first stage for a more complex attack.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000801.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x801	4148 bytes
SHA-256: `2941ae3f415e58c4fc58914a1860fe9dfc42a862c1385e81231c05741959a489`

Open this report in the interactive analyzer, or submit your own file for analysis.