RTF malware analysis — malicious · 739edc2bea872b78

MALICIOUS

RTF

2.9 KB First seen: 2022-12-13

MD5: 6186f6816589ce48b4a4a3fb2f53da9f SHA-1: cb5a88172a54e6e7115b23cc4b0fe86236a6592c SHA-256: 739edc2bea872b78f6deb65fa81171afebbb2c99abb0697db67b7ed2a34167fd

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this embedded object is designed to be automatically activated upon opening the document, likely exploiting a vulnerability to achieve code execution. No specific family is identifiable from the provided evidence.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000076.bin` `b0715f8c20d080a29f29f15d122cda40ef9ac45adf8fa61d512cc93f3970f1e9`	rtf-objdata-decoded	RTF \objdata at offset 0x76	1365 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.