RTF malware analysis — malicious · 8e1e47e161fc665a

MALICIOUS

RTF

3.8 KB First seen: 2023-10-03

MD5: ecade0af264b3a1f7d3a91a54c8aa4c1 SHA-1: 1c8a6fd038e391527a4e0fe497bfedf3b3c33457 SHA-256: 8e1e47e161fc665ab7b9ada82b9d9e348a058ee865982035c27e758409714f60

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and an \objupdate directive, indicating an attempt to trigger OLE object activation. This is a common technique for delivering and executing embedded malicious payloads. The specific payload and its ultimate destination could not be determined from the provided evidence.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000008a.bin` `f232b703f09f71b9cea5870014b0809900cff27f0d9d748e5b63a8f66292caf0`	rtf-objdata-decoded	RTF \objdata at offset 0x8A	1811 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.