Malicious RTF — malware analysis report

Static analysis result for SHA-256 7841ae2cf1dee8bf…

MALICIOUS

RTF

5.9 KB First seen: 2020-09-15
MD5: 3e7efd281edd4d09ae24e046561371a4 SHA-1: 0f27777dbeabc0abd4d8ee2745a5b1c468b009c7 SHA-256: 7841ae2cf1dee8bff2027d589170a3c820833b94536f8fe14724bcf2b8c69f03
60 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains OLE object data and an \objupdate directive, indicating it is designed to exploit a vulnerability to execute arbitrary code. The embedded OLE object is likely a payload, but its specific nature could not be determined from static analysis alone.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000004b1.bin rtf-objdata-decoded RTF \objdata at offset 0x4B1 2351 bytes
SHA-256: 311455e0507865a66d28155274fdb51c5eb44785ecde027ccb06597d4cc078c0

Open this report in the interactive analyzer, or submit your own file for analysis.