RTF malware analysis — malicious · 2c00daede45e1836

MALICIOUS

RTF

23.5 KB First seen: 2023-04-26

MD5: 8c04ebf8df5396b9d4cd12056d0a42fe SHA-1: cd587e704747c692d90f751b1dde95de9a282d10 SHA-256: 2c00daede45e18367160d5ad6e39e6fa26e4be1397758e387d2a7dfffc752519

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document containing embedded OLE object data. The RTF_OBJUPDATE heuristic indicates that the document attempts to force OLE activation, likely to execute the embedded object. This is a common technique for delivering malicious payloads. No specific family could be identified.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000c4e.bin` `5a8060c7d8f808a05a9252659e7316d2665fba993ada7a10ff6781759de93f86`	rtf-objdata-decoded	RTF \objdata at offset 0xC4E	4181 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.