Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 47317e88a97ef2bb…

MALICIOUS

RTF / .DOC

19.3 KB
MD5: 1faacf954c2b579305bab0ab1f09615c SHA-1: ad6764d4814bc42703cee1b0707047127a3dbc17 SHA-256: 47317e88a97ef2bbc0d7d7ccaa6753aa6742362d1b46d7337b7cc4b69a9c2dae
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.001 PowerShell

The RTF document contains embedded OLE objects, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that these objects are designed to be activated automatically, likely to execute malicious code. The presence of OLE object data strongly suggests an attempt to exploit vulnerabilities or trick the user into executing embedded content, leading to a malicious payload download and execution.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000c4e.bin
9ebd15fa6d98b1d25b57c7ead7341a8b453d2b51f9242ba59a27b9ae53b9a8de
rtf-objdata-decoded RTF \objdata at offset 0xC4E 1723 bytes