RTF malware analysis — malicious · 897b636eb7188114

MALICIOUS

RTF

24.7 KB First seen: 2023-05-31

MD5: 15d6c18e34ad68f0907981c8850ba29f SHA-1: 6b2b5090925f5538b57b0be8471081576fe6fdc3 SHA-256: 897b636eb7188114365d0570dc7091c32086b092f4bb08d04572952db09b22bb

100 Risk Score

Malware Insights

MITRE ATT&CK

T1559 Component Object Model Hijacking T1559.001 Component Object Model Hijacking: OLE

The RTF file contains OLE object data and heuristics indicate that \objupdate forces OLE activation. This suggests the file is designed to leverage OLE objects for malicious purposes, potentially to execute embedded code or exploit vulnerabilities. No specific family could be identified, and no further IOCs were extracted.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001113.bin` `13c73465c2a98398cb03adc6cbf586469e8d311cf3e080b2d6f1b5e23e59c1c4`	rtf-objdata-decoded	RTF \objdata at offset 0x1113	4182 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.