RTF malware analysis — malicious · 87bebed498b12a85

MALICIOUS

RTF

17.0 KB First seen: 2022-08-16

MD5: d93145b0b2ca5695cbbe5bce86e68951 SHA-1: 18716029bc76046e26be30f89a4aa212fcdf2080 SHA-256: 87bebed498b12a85b2a56efeb2b8af58e2e738aa540228a553db53850e1488ae

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains OLE object data and triggers heuristics related to OLE activation and native stream decoding. This indicates the file is designed to exploit vulnerabilities associated with embedded OLE objects, likely to deliver a secondary payload. The presence of OLE object data strongly suggests an attempt to leverage a known or unknown vulnerability for execution.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000005d0.bin` `26525f1e069c28d97ffe6e637f86fcd1e3dd6e009d79ccc4f31f49d168608ae9`	rtf-objdata-decoded	RTF \objdata at offset 0x5D0	4262 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.