RTF malware analysis — malicious · 4d3c12f04a545c45

MALICIOUS

RTF

11.9 KB

MD5: c0ad32de2eb00fe64aad5056fb888ab2 SHA-1: b28d883cb49837d4e4c72fc9da4eb416df828e6e SHA-256: 4d3c12f04a545c45c126081b9c577734e1c99e7af54bb638ac56369048e94ab4

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The RTF file contains embedded OLE objects that are configured for automatic updates, indicating an attempt to exploit user interaction for code execution. The presence of RTF_OBJDATA, RTF_OBJAUTLINK, and RTF_OBJUPDATE heuristics strongly suggests a malicious OLE embedding technique. While no specific script was extracted, the embedded URL heuristic points to a potential download or redirection mechanism. The overall pattern is consistent with a malicious document designed to leverage OLE vulnerabilities.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001c83.bin` `7f8202bb79c2fc2e553b0505f08d8a881887b3e11bdcbbbb45b143665ff7ebf5`	rtf-objdata-decoded	RTF \objdata at offset 0x1C83	1709 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.