RTF malware analysis — malicious · 52a6c71e63ed3857

MALICIOUS

RTF

12.7 KB

MD5: 137af33b1dc991645b16da2688f9f4b3 SHA-1: d6d9de9a098e48e29a4cb9ca12daf6f3d4644747 SHA-256: 52a6c71e63ed3857be2fa0fb314ce631820994fb7e852fb66bca923efbee2380

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.001 PowerShell

The RTF document contains OLE object data and is configured to automatically update and activate these objects, indicating an attempt to exploit OLE vulnerabilities. The presence of embedded URLs suggests a delivery mechanism for further malicious content. The high risk score and unknown exploit score further support a malicious classification.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001fce.bin` `aeb2469d088b598ec2bb98a1505f0ba97241eefaefc7b86c299d18d155ecb1eb`	rtf-objdata-decoded	RTF \objdata at offset 0x1FCE	1777 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.