RTF malware analysis — malicious · 488c4d19c80463fb

MALICIOUS

RTF

179.7 KB First seen: 2024-06-25

MD5: 6e11c40fcc227fab4b32f8c3b275b57c SHA-1: 29b8df42eb2913e74d008a71331ccbb030520292 SHA-256: 488c4d19c80463fbd6c2284392ac296397a1ca4b0070c1c3f3859bafcc8fd22c

80 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1027 Obfuscated Files or Information

The RTF document contains embedded OLE object data, indicated by RTF_OBJDATA and RTF_OBJEMB heuristics. The RTF_OBJUPDATE heuristic suggests that this embedded object is designed to be activated automatically, likely leading to the execution of a secondary payload. The presence of objdata suggests a complex embedded structure, and the decoded objdata artifact is listed as a potential IOC.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001407.bin` `dcb449a4406b485ac39bc3627a722a624303813af65931d8bd5ebe1f32f25037`	rtf-objdata-decoded	RTF \objdata at offset 0x1407	4177 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.