Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 74a772134e325f53…

MALICIOUS

RTF / .DOC

5.0 KB First seen: 2023-02-13
MD5: f171857a9cc7939cc152f43316ee30d9 SHA-1: 50a88884f5cae5469a6558e67fbf3bc12b473a5b SHA-256: 74a772134e325f53cb54809a228f2cf32763ecd6138d67160d9ab14f6e65ed4b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains embedded OLE object data and a directive to activate it, indicating an attempt to exploit a vulnerability. The presence of ".objdata" and ".objupdate" heuristics strongly suggests the document is designed to trigger an embedded object, likely for malicious code execution. The specific exploit is not detailed, but the mechanism points to a downloader or dropper.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000007b.bin
0713c356c0f74d6ba85a0a22f8fcb002bae564f9da3dab244b0e9d7cd119162b
rtf-objdata-decoded RTF \objdata at offset 0x7B 2443 bytes