RTF malware analysis — malicious · 87d74e18791260ee

MALICIOUS

RTF

27.1 KB First seen: 2023-06-13

MD5: f0b5a393cccd0dad6fad80352a1f89b9 SHA-1: 3a803eeb952d216d9190565430c2289663612a1b SHA-256: 87d74e18791260ee59c94b4c2a095c70695a70013983439d0d899ff3aff88e9d

100 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking T1137.001 DLL Search Order Hijacking

The RTF document contains OLE object data and uses \objupdate to force OLE activation, indicating an attempt to exploit vulnerabilities associated with OLE objects. The embedded OLE object was decoded and extracted as 'objdata_00_off000019bd.bin', which is the primary indicator of compromise. The specific attack pattern suggests leveraging OLE for code execution.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000019bd.bin` `06483c30e9eb575e7641158d524af6240ef2c084f15aa520b8860d28f45d3d9a`	rtf-objdata-decoded	RTF \objdata at offset 0x19BD	4198 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.