RTF malware analysis — malicious · 579a4b676b32f4b2

MALICIOUS

RTF

495.5 KB First seen: 2024-06-28

MD5: 59b0a52923657719a25491e676229659 SHA-1: c0ed3dabc720300970dfe485c49d00499e86c915 SHA-256: 579a4b676b32f4b2af28babb7d0c7c3f04db59d5437341fa918cc38236d14c6b

100 Risk Score

Malware Insights

MITRE ATT&CK

T1204 User Execution: Malicious Link T1566.001 Phishing: Spearphishing Attachment T1187 Exploitation for Client Execution

The RTF file contains embedded OLE object data and heuristics indicate that \objupdate forces OLE activation, a common technique for executing embedded malicious content. The document body provides a lure, instructing the user to 'click Enable editing from the yellow bar above', which is a typical method to bypass macro security settings and execute the embedded payload.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0002b86e.bin` `5337c29bd298b9006c0dec62998ce91effa1b32e653d173f5cace6afc6693788`	rtf-objdata-decoded	RTF \objdata at offset 0x2B86E	1526 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.