Malicious RTF — malware analysis report

Static analysis result for SHA-256 4c17951fe8ce164b…

MALICIOUS

RTF

3.3 KB
MD5: 7aeeb42112dd5bad4966cec86fb28a0b SHA-1: a2f62863582dad942f7a51f93e3302ab8b83e1e5 SHA-256: 4c17951fe8ce164bbeffa514861c191dc57da3f676ae0e7e19ef62384125c127
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and utilizes the \objupdate directive, indicating an attempt to exploit OLE activation. This suggests the file is designed to deliver a payload when opened. The SHA256 hash is included as a primary indicator.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000008d.bin
21581a2cbf6b4f96372e67f9910928634a9a5cd8ed5d16806af98bd8d17449e0		 rtf-objdata-decoded RTF \objdata at offset 0x8D 1577 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.