RTF malware analysis — malicious · 52771eb24bbd45e8

MALICIOUS

RTF

3.8 KB First seen: 2022-10-06

MD5: e6c8a453f913b4696b32fe528c3013f6 SHA-1: 81a7c036f25ca1bf257f39a986f0f05231bb7fef SHA-256: 52771eb24bbd45e8b8729d219ade7c0224c17cbd6111aa5c53f94595b3674377

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains an embedded OLE object, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be automatically activated, likely exploiting a vulnerability in the host application to execute arbitrary code. The specific exploit or payload is not detailed in the provided evidence.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000007c.bin` `551fe9b763160459b21dd54c3883cc0092b69c5e791cdf71a7181d67d381d10d`	rtf-objdata-decoded	RTF \objdata at offset 0x7C	1856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.