RTF malware analysis — malicious · 87fbbb3c935d452d

MALICIOUS

RTF

176.9 KB First seen: 2024-06-28

MD5: 156416193f15a637f5c6b4c8ad5a91b8 SHA-1: 7da94ec10520e7b3bd74ed698d175846d0d31914 SHA-256: 87fbbb3c935d452da6f1ceeeb320975fab60652cf84fa4e01a76b1230cbf1262

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File Execution: Malicious Attachment

The RTF file contains OLE object data and uses \objupdate to force activation, indicating an attempt to execute embedded content. The presence of Ole10Native stream further supports the embedding of an executable object. While no specific payload or URL was directly extracted, the heuristics strongly suggest a downloader or exploit delivery mechanism.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000014cd.bin` `3e5643fc383a8754d19c6ca1886f77c1cf6644914f7353fb09686ac25015e867`	rtf-objdata-decoded	RTF \objdata at offset 0x14CD	4183 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.