Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 7f6bc16f735a1192…

MALICIOUS

RTF / .DOC

110.4 KB
MD5: 596eb4eb179f53060694bcfa86d9eaee SHA-1: ba793039e31873add813f2b5ab672967ad642605 SHA-256: 7f6bc16f735a11929fd0dc7dd88de6e0412b223e7cfba2a3942a3435368db9d4
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The RTF document contains OLE object data and an \objupdate directive, indicating it's designed to activate embedded objects, a common technique for delivering malicious payloads. The heuristics suggest the file is structured to exploit OLE object handling. No document body or script content was available for further analysis, limiting the ability to determine the specific payload or family.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000020b3.bin
022632a3f95e89b8a7964be972fdceb417638c8183b6b2d811b1e664157b1248
rtf-objdata-decoded RTF \objdata at offset 0x20B3 4291 bytes