RTF malware analysis — malicious · 5408a39a02e1fc04

MALICIOUS

RTF

69.6 KB First seen: 2023-08-28

MD5: dfa3f8cbec6876eecd7e992182e5e670 SHA-1: 8f570e33d17e92e320a4acd19a9b18ffa6d101d8 SHA-256: 5408a39a02e1fc04bc75fc2aca0e840f72e5520dbbaf0761955ee68f7279dc30

100 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

The RTF file contains OLE object data and an ".objupdate" directive, indicating it's designed to activate embedded objects. The heuristic SE_ENABLE_LURE confirms the document instructs the user to enable editing, a common tactic for macro-based malware droppers. The document body discusses financial audits, likely a pretext to trick users into enabling malicious content.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003cc2.bin` `f652eaa29b5d4e9febe830c923942d484c9fc01cf109349860fdd0d16fce3123`	rtf-objdata-decoded	RTF \objdata at offset 0x3CC2	4173 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.