RTF malware analysis — malicious · 3b036cd33abd8966

MALICIOUS

RTF

16.8 KB First seen: 2018-10-07

MD5: de7d741e3d104ea6174d7c3384e253cc SHA-1: e935037d8ad18f956be36d0d399a8e31b04c3db1 SHA-256: 3b036cd33abd89660b9bc2ac27cd0bc0ebbc2cec09a14a1a18fc6a64bc107136

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and triggers an \objupdate event, indicating exploitation of a vulnerability to execute embedded code. The presence of RTF_OLE10NATIVE_STREAM further confirms the embedded OLE object. While no specific payload or URL is directly visible, the technique strongly suggests the file is designed to download and execute a secondary stage, characteristic of a malicious attachment.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000cd7.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xCD7	4651 bytes
SHA-256: `05045181c5c59801ace8efd4445e21dfa3f6824f397601507eea1ee666fd58db`

Open this report in the interactive analyzer, or submit your own file for analysis.