RTF malware analysis — malicious · 7f8048951379614c

MALICIOUS

RTF

450.1 KB Created: 2021-07-30 23:08:00

MD5: 409367d7c4ddf7e3d0e1bde3227bc37b SHA-1: 041a497ae5a87ccb6a6cbaf787c46b06f28e56b7 SHA-256: 7f8048951379614c56a10eafa2c60712038a833cdfe7835b1e3af1dc5f220b74

104 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains OLE object data that is automatically linked and updated, indicating an attempt to execute embedded content. The heuristic firings suggest exploitation of OLE object handling to achieve code execution. The extracted artifact 'objdata_00_off000078f1.bin' is likely the payload or exploit code.

Heuristics 5

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000078f1.bin` `22423c465021a729c72ee7bf3ef251e67986279147831480c4bc1a450caa318f`	rtf-objdata-decoded	RTF \objdata at offset 0x78F1	75464 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.79, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.