Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 58ce063b0d0fd247…

MALICIOUS

RTF / .DOC

52.8 KB
MD5: 7e76dde042f79b2216713b2d86110d75 SHA-1: dfa4f708534f56df03b96572cc9bdfcfbbc3a795 SHA-256: 58ce063b0d0fd247f0bd4386bcd11523c72d5d9845157ef6c9b9f206ca16cd7b
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File T1027 Obfuscated Files or Information

The RTF file contains embedded OLE object data which is configured to automatically update and activate. This suggests the file is designed to exploit OLE object vulnerabilities to execute arbitrary code upon opening. No specific malware family could be identified, and no further IOCs were extracted.

Heuristics 3

  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000e1d.bin
28fa900cbd0a53cdffe4a892d46808b6b71d99924b26e440a7d8ba48694583a3
rtf-objdata-decoded RTF \objdata at offset 0xE1D 1957 bytes