RTF malware analysis — malicious · 3d412952806f608b

MALICIOUS

RTF

384.0 KB First seen: 2019-08-04

MD5: 1c466ec60116cbc17ad39af91f9d73be SHA-1: f478790c9c2509d929808263d06dcd225aad6a3a SHA-256: 3d412952806f608b4c24d8a9c3e89452a210980fd415c49831d1dc3116aa3ce7

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data that is forced to activate via \objupdate, indicating an attempt to execute embedded code. The decoded OLE object stream, objdata_00_off00000bf6.bin, is the primary artifact suggesting malicious execution. This technique is commonly used to bypass security controls and download further malicious content.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000bf6.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xBF6	4663 bytes
SHA-256: `bb3514919b4e549fbcd7aa92f5933db4a9728707cf492dd7b1aff317f3a1f45a`

Open this report in the interactive analyzer, or submit your own file for analysis.