RTF malware analysis — malicious · 72d39c29d29217fe

MALICIOUS

RTF

37.8 KB First seen: 2022-12-16

MD5: e8cd37cdb75b3db0b9379963cfab5cfe SHA-1: 1a16ba4478e00e25985f4eeefbdc2dc8cf540449 SHA-256: 72d39c29d29217fe8430dffe3bbc7aad2ed70d230e0b78f1dafa1a9d733566ee

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File

The RTF file contains an OLE object and an instruction to 'Enable editing', which are common lures to trick users into activating embedded malicious content. The heuristic 'SE_ENABLE_LURE' specifically indicates that the document instructs the user to enable macros or editing, a typical dropper behavior. No specific malware family could be identified from the available evidence.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00007f72.bin` `59835a04a9117314a12f976b362a4a473ebd40e66aa00ec7eadbab8230b29dbc`	rtf-objdata-decoded	RTF \objdata at offset 0x7F72	1497 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.