RTF malware analysis — malicious · 3bbc61eaa4e324c3

MALICIOUS

RTF

207.8 KB First seen: 2018-06-14

MD5: 10e83412b03ea1fc949118261f205dba SHA-1: aede4ed6c360c11b9d5f8d1af4b528e1d8e312cb SHA-256: 3bbc61eaa4e324c3a6c1d01b0e9e628436b36af83ac2038e163eda58165f1981

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and uses \objupdate to force activation, indicating an attempt to exploit a vulnerability for client execution. The presence of OLE object data strongly suggests the file is designed to deliver a secondary payload. Without further script or body content, the exact nature of the payload remains unknown.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000003c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C	4142 bytes
SHA-256: `c65eb7cd34a0226f75368c7799a67dc377cccf7a2c1556a900e2da2bdd801a87`

Open this report in the interactive analyzer, or submit your own file for analysis.