Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 373ca2f299acaf01…

MALICIOUS

RTF / .DOC

52.0 KB
MD5: 6e7d9c64b1a463ea64520eaea68a044f SHA-1: 50d32bc7e2abfc5e897cc6d616d94c48adf980e4 SHA-256: 373ca2f299acaf012ed9dfbae70579e10f49d881f669ef215e6d611faa78c818
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and a \objupdate directive, indicating an attempt to exploit vulnerabilities related to OLE object activation. The presence of embedded OLE object data suggests the document is designed to deliver and execute a payload when opened. No document body or script content was available for further analysis.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001844.bin
cd0cc2f117b5f2d67633c60db7af8e0af77eb120ccab9f347bc62ad384f32ddb
rtf-objdata-decoded RTF \objdata at offset 0x1844 1794 bytes