Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 666158257d7821d5…

MALICIOUS

RTF / .DOC

3.7 KB
MD5: 6f1d207191f804f23644dfe63bdca4f4 SHA-1: 0c6e82734ab890cf459cc065c54a1ae3a7f9652d SHA-256: 666158257d7821d5a1bb2609d77e6bd01fb6b95bddc6aa76f6b0ffef985f1db4
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be activated, likely leading to the execution of malicious code. The specific exploit or payload is not discernible from the provided evidence.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000052.bin
699bb07975e617a1a9e22e2935ba270f029fa62ae0180b357b3bd24bb1a6e27e
rtf-objdata-decoded RTF \objdata at offset 0x52 1748 bytes