RTF malware analysis — malicious · 3229f91724f5e886

MALICIOUS

RTF

141.7 KB

MD5: cc6ed2ad219367f2e152591fa9df0e26 SHA-1: e3a2aceebeb32231825a7f94e702136956f453c8 SHA-256: 3229f91724f5e88645b11a9d6af64d46260a6f692e6aee26eb43c161d0b8ef13

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1137.003 DLL Search Order Hijacking

The RTF document contains OLE object data and is configured to automatically update and activate these objects. This indicates a likely attempt to exploit vulnerabilities or deliver a payload via embedded OLE objects. The heuristics strongly suggest that the RTF is designed to trigger the execution of embedded content upon opening, which is a common delivery mechanism for malware.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001f4f.bin` `db72b48ccfd24a265e7f2af7d818b29dcfa33b9e173e5e612ae61ca743bf8b28`	rtf-objdata-decoded	RTF \objdata at offset 0x1F4F	47253 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.