RTF malware analysis — malicious · 4cc43b3af7bd903f

MALICIOUS

RTF

14.0 KB First seen: 2023-02-20

MD5: 7ce90ac0bdc6b44b538e1196f41de730 SHA-1: beb39e21507c5b76b2c1bf63dee06e987d0cb422 SHA-256: 4cc43b3af7bd903ff5edba267c126237c7cd9c0e7ba706f019a30d0af3f4a5a7

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document that contains OLE object data. The RTF_OBJUPDATE heuristic indicates that the document attempts to force OLE activation, likely to execute the embedded object. This suggests a malicious document designed to exploit OLE vulnerabilities or deliver a payload via embedded objects.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001eb0.bin` `c121a435e74eaadec0bd2450e75ae8b77a25a3eca18c2bdf58cb91440c1b489b`	rtf-objdata-decoded	RTF \objdata at offset 0x1EB0	1373 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.