Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 4022cb6d11ca62e2…

MALICIOUS

RTF / .DOC

25.3 KB First seen: 2022-04-14
MD5: c0bca9aece9a2fecfc0aded9ac7b5c7b SHA-1: c1612bcc0675dd272dd2a6434332e8730e10b037 SHA-256: 4022cb6d11ca62e2cb20c84cdd246396fd51699973d84e61a719b888eadac107
153 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains embedded OLE objects that are automatically linked and updated, indicating an attempt to execute embedded content. The heuristic firings strongly suggest the use of OLE object manipulation to achieve code execution. While no specific script was extracted, the OLE object data itself is likely malicious, potentially leading to a secondary payload download or execution. The confidence is high due to the multiple high-severity RTF heuristics firing.

Heuristics 4

  • Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM
    RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001fa8.bin
f9cd18f70880bb5a57748314d6af861a7225580d4fced52141ee90ea9b1910f7
rtf-objdata-decoded RTF \objdata at offset 0x1FA8 4186 bytes