RTF malware analysis — malicious · 79d54eaa9b7b9ef2

MALICIOUS

RTF

241.6 KB First seen: 2022-04-04

MD5: f76e9cda282c123248384c306a2b16d9 SHA-1: c2fbd48b47abf7893413a9761ae934aea8ff0bb3 SHA-256: 79d54eaa9b7b9ef22c0abe3c8f43db1500894d4af22f3a098a16ad8ad0e72fe7

123 Risk Score

Malware Insights

MITRE ATT&CK

T1559.002 Component Object Model T1204.002 Malicious File

The RTF document contains multiple OLE objects, with heuristics indicating the use of ".objupdate" and Composite Monikers. This suggests the file is designed to exploit OLE object activation to execute arbitrary code. The embedded OLE objects are the primary mechanism for this attack, likely leading to a second-stage payload execution.

Heuristics 4

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000007d0.bin` `1e283d5812afed3794b0e1b3cf15b330844a1823134561b9b44d33795160b4f2`	rtf-objdata-decoded	RTF \objdata at offset 0x7D0	27565 bytes
`objdata_01_off0000e864.bin` `1721aab459b68b884f13b5caf8aed48f2f1a5eb3d65c1b2ddac08c7c93062de4`	rtf-objdata-decoded	RTF \objdata at offset 0xE864	2632 bytes
`objdata_02_off0000fe07.bin` `44deae4627fee3c44f54d5bd10477ec2e17f4c08135f08e2417832e36d10d037`	rtf-objdata-decoded	RTF \objdata at offset 0xFE07	12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.