RTF malware analysis — malicious · 72d66b77bf74040c

MALICIOUS

RTF

20.5 KB

MD5: 0c47a0b35e4e809bb002bb9a41b7a6a2 SHA-1: 5bd76ab1570062d5a78c2dcd70025b18f48be251 SHA-256: 72d66b77bf74040c75ccbe723b24ea56d0a6ac0cef16bcd68a68a054c04b67b9

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an RTF document containing OLE object data that forces OLE activation. This indicates the document is designed to exploit vulnerabilities or trigger embedded content upon opening, likely as a spearphishing attachment. The specific OLE stream found suggests the embedded object is a native OLE object, commonly used to deliver second-stage payloads.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001072.bin` `26888c204c023046769d1a89cb43f9e9c7d64b7997750fb7f225ab4ec9a67c79`	rtf-objdata-decoded	RTF \objdata at offset 0x1072	3658 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.