Malicious RTF — malware analysis report

Static analysis result for SHA-256 4155ae48a790b1b5…

MALICIOUS

RTF

111.8 KB Created: 2021-07-16 07:42:00
MD5: 53998df11a485481964087b7ac5a46b2 SHA-1: bc605b00be1a5c9581ff7f7d6a48c8e2619f055c SHA-256: 4155ae48a790b1b5cb79a357e6eaf6ef76a7c358177d530878ba4c7a3df3cea6
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains embedded OLE objects, indicated by RTF_OBJDATA and RTF_OBJEMB heuristics. The presence of a Composite Moniker further suggests a potential exploitation vector. While no specific malware family is identified, the techniques point towards exploiting client-side vulnerabilities via an embedded object, likely delivered as a spearphishing attachment.

Heuristics 4

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000032e9.bin
5bc10a0573480da9b126edb352c1edd12fa03c1dd528e685cf6735e21f91315d		 rtf-objdata-decoded RTF \objdata at offset 0x32E9 3452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.