RTF malware analysis — malicious · 467f70e52f6d8e45

MALICIOUS

RTF

383.9 KB First seen: 2024-06-03

MD5: 7c739b24e085bf5b3375056ca7eb1db7 SHA-1: 89551d04ee755e8a5fadd75ee21bd47d745d6f4b SHA-256: 467f70e52f6d8e45b6d39caacbf48f83fd7c007535992bb2a4ce60f3b3b35fc3

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

The RTF file contains OLE object data and uses an \objupdate directive, indicating it's designed to activate embedded objects. The SE_ENABLE_LURE heuristic confirms the document instructs the user to enable editing, a typical social engineering tactic to bypass security measures and execute malicious content.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00016098.bin` `2257a2500e7875e11d3dd8aa8064bc21f193642319a6aeb90efaa004ed8cfed2`	rtf-objdata-decoded	RTF \objdata at offset 0x16098	1808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.