RTF malware analysis — malicious · 6bb4bc099c4b6b19

MALICIOUS

RTF

472.2 KB First seen: 2023-08-08

MD5: 2b6079d76ec19f9ac5281bf5160acbdc SHA-1: 8995ebd67c97bdbd37c1d1424c41d0a5b103626e SHA-256: 6bb4bc099c4b6b193358631ba4a2bfc728c565297e395ab72274a226174cb7f7

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this embedded object is intended to be activated, which is a common technique for delivering malicious payloads. The specific nature of the payload is not clear from the provided evidence, but the overall pattern points to a malicious document designed to exploit OLE object activation.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000011fa.bin` `9c1d7a6b587971ec8d50bd1cabd0623457290217180b8e5f838d289d67fb8438`	rtf-objdata-decoded	RTF \objdata at offset 0x11FA	4176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.