Malicious RTF — malware analysis report

Static analysis result for SHA-256 2443952e39304e83…

MALICIOUS

RTF

3.9 KB First seen: 2022-12-15
MD5: f66af6772410d7d349c125ff3cd2c831 SHA-1: 3622b0ea26cd7076bee9042728ebdf4024fe8b0c SHA-256: 2443952e39304e83c9274d00ec17d9003f5916a759c175c22af1c42b476ed042
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and an \objupdate directive, indicating it is designed to trigger the execution of embedded malicious content. This is a common technique for delivering second-stage payloads.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000074.bin
d2c497a78addfcd8b2cc34491cea035a2bc359e26897794b557c8234f1073bb5		 rtf-objdata-decoded RTF \objdata at offset 0x74 1881 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.