RTF malware analysis — malicious · 5806ff817e0b0c3c

MALICIOUS

RTF

5.9 KB

MD5: 7fbbd3038fcb18fba29a100ed36821ad SHA-1: 71cc266a7f1ddd0b5b968e267cdf51776e0e7b55 SHA-256: 5806ff817e0b0c3c57e727b04c77411487179c3676150f3f1cf536d3fac33fa5

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is an RTF document that contains OLE object data and triggers an OLE object update, indicating an attempt to exploit embedded object vulnerabilities. The presence of an embedded OLE object suggests a delivery mechanism for a secondary payload. The heuristics indicate a high likelihood of malicious activity related to OLE object activation within the RTF structure.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000577.bin` `20aba20f76e2122b9de264801eb0a84bf1ea82cf5bc1569edff3d1dd3423c357`	rtf-objdata-decoded	RTF \objdata at offset 0x577	1606 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.