RTF malware analysis — malicious · 7944fa9cbfef2c7d

MALICIOUS

RTF

121.5 KB Authoring application: Msftedit 5.41.21.2510 First seen: 2022-06-20

MD5: 8cdd56b2b4e1e901f7e728a984221d10 SHA-1: cb8eb16d94fd9242baf90abd1ef1a5510edd2996 SHA-256: 7944fa9cbfef2c7d652f032edc159abeaa1fb4fd64143a8fe3b175095c4519f5

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE objects, with one specifically triggering an \objupdate heuristic, indicating an attempt to activate embedded content. The document body impersonates a government warning about phishing and credential theft, likely as a pretext to trick users into interacting with the embedded malicious content. No scripts were extracted, limiting further analysis of the payload.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://cert.gov.ru/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001f1a.bin` `1528ff87682de1c81e763f3c9f100ece1e8adf29a88da92a7b02ab472bf99079`	rtf-objdata-decoded	RTF \objdata at offset 0x1F1A	51196 bytes
`objdata_01_off0001af38.bin` `624cd8895a4ecc5a0a871cb6215c2b19f4fae3b522107541fa9df8c8983ecb35`	rtf-objdata-decoded	RTF \objdata at offset 0x1AF38	6847 bytes
`objdata_02_off0001af52.bin` `05ba095ac605422898d063511280e25730e5e1dd91478e3cd20e32a7ee2beec8`	rtf-objdata-decoded	RTF \objdata at offset 0x1AF52	6843 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.