RTF malware analysis — malicious · 8e32b8fdc7c08414

MALICIOUS

RTF

24.9 KB First seen: 2023-07-27

MD5: 0697564d77f5fbf7c18d046b70afecb1 SHA-1: 2dc13c2c234e27c1503a491ef8580ce9d1ee574d SHA-256: 8e32b8fdc7c08414a82662fa1a6e0c92a1332631c60e96760a6dec9f3fe07978

100 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model

The RTF file contains OLE object data, indicated by RTF_OBJDATA heuristics. The RTF_OBJAUTLINK and RTF_OBJUPDATE heuristics suggest that the embedded OLE object is automatically linked and its activation is forced, which is a common technique for delivering malicious payloads. No document body or script content was available for further analysis.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001043.bin` `c029e9bfd1bcbd833c8fefb485a7803723bfb8f9e973622d54eb12763cc90e46`	rtf-objdata-decoded	RTF \objdata at offset 0x1043	4182 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.