Malicious RTF — malware analysis report

Static analysis result for SHA-256 80d7e56ff134ab03…

MALICIOUS

RTF

9.2 KB First seen: 2020-08-25
MD5: 290b01adf919c64eafa3cd77b033d07e SHA-1: 9a802fe688b8856d11cb3d513035538eeae5111b SHA-256: 80d7e56ff134ab033bc82ec345740abb489a313066f37ca28abf6f756e77f987
60 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and an \objupdate directive, indicating an attempt to exploit OLE activation for client execution. This is a common technique for delivering malicious payloads via spearphishing attachments. No specific family could be identified from the available evidence.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001639.bin rtf-objdata-decoded RTF \objdata at offset 0x1639 1676 bytes
SHA-256: 1d230507067ec183b39a4e309a8fef7d34e60cde6db20270e4066b80c72f120f

Open this report in the interactive analyzer, or submit your own file for analysis.