RTF malware analysis — malicious · 59d4d5381dcca8cb

MALICIOUS

RTF

13.7 KB

MD5: 4c6f57dbe214173142c5b59cbded3183 SHA-1: c1ef16421d739fc0146afac48e68612c475f5a9b SHA-256: 59d4d5381dcca8cba39967e8e732d7444263664503f6201bf9385a73254e584f

80 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains embedded OLE objects, indicated by the RTF_OBJDATA and RTF_OBJEMB heuristics. The RTF_OBJUPDATE heuristic suggests that the embedded object is designed to be automatically activated upon opening the document. While no specific script or URL was extracted, the structure strongly implies a malicious intent to exploit OLE object handling for payload delivery. The confidence is moderate due to the lack of explicit payload indicators.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000201b.bin` `511f2aee865d46b78c870487a57cfd02802aee376b562ec6b79b30242111db6a`	rtf-objdata-decoded	RTF \objdata at offset 0x201B	2098 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.