RTF malware analysis — malicious · 34d658e5105a275a

MALICIOUS

RTF

218.0 KB First seen: 2022-04-08

MD5: 4974fc522ae6406baeb41482fc54c5dd SHA-1: 0355b93214fb4d137be60762f7711a1013ade320 SHA-256: 34d658e5105a275ae62361e95b9b9a0f5d84865e74da1e132bd0cd822d93a75a

123 Risk Score

Malware Insights

MITRE ATT&CK

T1559.002 Component Object Model Hijacking T1204.002 Malicious File

The RTF file contains multiple embedded OLE objects, with heuristics indicating the use of \objdata and \objupdate directives. This suggests the file is designed to exploit OLE object activation to execute arbitrary code. The presence of composite monikers further supports this, pointing towards a mechanism for loading and running external or embedded malicious components. No document body text was available for further context.

Heuristics 4

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000007d0.bin` `a03352c6dc4a5b96c6ce95c322b380260addad1d9cdd7de976e8007f2f0a1873`	rtf-objdata-decoded	RTF \objdata at offset 0x7D0	15933 bytes
`objdata_01_off000089e2.bin` `1721aab459b68b884f13b5caf8aed48f2f1a5eb3d65c1b2ddac08c7c93062de4`	rtf-objdata-decoded	RTF \objdata at offset 0x89E2	2632 bytes
`objdata_02_off00009f85.bin` `44deae4627fee3c44f54d5bd10477ec2e17f4c08135f08e2417832e36d10d037`	rtf-objdata-decoded	RTF \objdata at offset 0x9F85	12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.