RTF malware analysis — malicious · 3b4f7b4ff376ac19

MALICIOUS

RTF

19.4 KB

MD5: 226035129ac9645a54d6e4af36f5b5b0 SHA-1: 29453d93c6630cab5c4dcfc2e37ef2ad62961eb4 SHA-256: 3b4f7b4ff376ac19be618e865339545440ec7cd18e3a260df8a1aaf4ed867a57

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File T1059.001 PowerShell

The RTF document contains OLE object data that is forced to activate via \objupdate, indicating an attempt to exploit OLE object vulnerabilities. The presence of \objdata and \objupdate heuristics strongly suggests that the RTF is designed to embed and execute malicious content. While no specific script was extracted, the structure points towards a downloader or exploit delivery mechanism.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000a9b.bin` `f4cd1ad6f549f69c883e8439220e11c02efa9463f4655170dae010c8ce4cdb86`	rtf-objdata-decoded	RTF \objdata at offset 0xA9B	3672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.