RTF malware analysis — malicious · 479a4458768a4f2d

MALICIOUS

RTF

31.3 KB First seen: 2023-05-10

MD5: 00a01e52c1cea67f0060dc808ed99ab7 SHA-1: 5b821ae2fc02b24c646c65d36726eedd1d269c09 SHA-256: 479a4458768a4f2d74f3ef0b9d760ea7c4f6308ce330ecf491a008775f3f2889

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF file containing OLE object data and an \objupdate directive, indicating an attempt to automatically activate embedded objects. This is a common technique for delivering malicious payloads. No document body or script content was available for further analysis, limiting the ability to identify specific IOCs or family.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002076.bin` `e3d857bf15d8ce3637e151bcce7bc8106587691a25e32692cd84e8c9cc355200`	rtf-objdata-decoded	RTF \objdata at offset 0x2076	4693 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.