RTF malware analysis — malicious · 8cd5b74e558ebd50

MALICIOUS

RTF

7.6 KB

MD5: 01a61f8646cf09a907c9876b2a3f0227 SHA-1: 4053e61fb55ded62fad3758733b32a8217f3e758 SHA-256: 8cd5b74e558ebd50c6529a9d8c0075aba067e6867f99a90a8152979f69ad9f68

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and an \objupdate directive, indicating an attempt to embed and activate an object. This is a common technique for delivering malicious payloads. While no specific URLs or scripts were extracted, the presence of these RTF-specific indicators strongly suggests a malicious intent to exploit OLE object activation. The confidence is moderate due to the lack of concrete payload indicators.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000bb9.bin` `e308bc6aeac6a18be5f3b74242773f52cfd867a5dddc000ea1c9b4eb036f8b4d`	rtf-objdata-decoded	RTF \objdata at offset 0xBB9	1719 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.