RTF malware analysis — malicious · 75baa768f4672768

MALICIOUS

RTF

25.8 KB First seen: 2023-06-02

MD5: b7317b332d56b95754a97d72aab04605 SHA-1: 5c65d2f1415e0ee342efcb00cd754453b508f6d9 SHA-256: 75baa768f4672768efde37f7eaecf62590d1f1ae0ec29d322c7c5c4d8d97a42b

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document containing OLE object data and triggers for OLE activation. The presence of `RTF_OBJAUTLINK` and `RTF_OBJUPDATE` heuristics strongly suggests that the document is designed to automatically activate embedded OLE objects, which is a common technique for delivering malicious payloads. The embedded OLE object data (`objdata_00_off00001344.bin`) is the primary indicator of compromise.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001344.bin` `256bfcdb4e9031815632eb029728c5bf1e48edce9665c759a3cbd66d8a6e419c`	rtf-objdata-decoded	RTF \objdata at offset 0x1344	4194 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.