RTF malware analysis — malicious · 4300c64beda23a5d

MALICIOUS

RTF

456.7 KB First seen: 2020-09-15

MD5: 9a72ef3c69e3de2cea45226637a94912 SHA-1: f506271bb419c1742bcc5f9a77593210cf236c88 SHA-256: 4300c64beda23a5d2e66a6ef3428814fcb9a93686555f80acdd55e7d6454dd8c

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File T1059.001 PowerShell

The RTF file contains OLE object data and uses \objupdate to force OLE activation, indicating an attempt to exploit a vulnerability. A suspicious artifact, objdata_00_off00001591.bin, was extracted. The high heuristic score for \objupdate suggests a high likelihood of code execution.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001591.bin` `7cdc02306f427e4579704b5b6373e99400198f6ef3b95f6b377c82dc148f06d3`	rtf-objdata-decoded	RTF \objdata at offset 0x1591	231058 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 8.00, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.