Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 2ba8e3e280bef1f9…

MALICIOUS

RTF / .DOC

98.6 KB
MD5: 641366a9a3f0ac19db94175320a307fe SHA-1: 629e441974614b18771ad50858acb845104b1ea0 SHA-256: 2ba8e3e280bef1f9f8e1118e0dd2a2dcb14c324924fe379270aac992ef110114
80 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious File: Malicious Attachment

The RTF document contains embedded OLE objects, indicated by the RTF_OBJDATA and RTF_OBJEMB heuristics. The RTF_OBJUPDATE heuristic suggests that these objects are designed to be activated automatically, which is a common technique for executing embedded code. The objdata_00_off00001507.bin artifact is the decoded OLE object data, likely containing the malicious payload.

Heuristics 3

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001507.bin
b48f07b4f8175a1c97ceb114eaa5337a75a6db59a850f2f41542c6737bb03026
rtf-objdata-decoded RTF \objdata at offset 0x1507 4278 bytes