RTF / .DOC malware analysis — malicious · 90869c88b894aa4b

MALICIOUS

RTF / .DOC

79.6 KB

MD5: 4667fd881bbe82b6da8e5abd543eacc5 SHA-1: b7eea880434bdeed32c3c6267f2460f5de9db147 SHA-256: 90869c88b894aa4b56ad98df444a36cb7f6122a395902ec74850638610019e49

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The file is an RTF document exhibiting high-confidence heuristics for OLE object embedding and automatic updates. This suggests the document is designed to exploit user interaction to activate embedded objects, which typically leads to the download and execution of a secondary payload. The specific RTF heuristics indicate a mechanism for triggering this activation, likely involving a malicious link or script embedded within the OLE object. Without further script analysis or document body content, the exact payload and delivery mechanism remain uncertain, hence the 'unknown family' designation.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000f3b.bin` `952dd4147254d1da2fed2a38f15b74b2cf3cb3b3131127398a1bd3840f4bcc3c`	rtf-objdata-decoded	RTF \objdata at offset 0xF3B	4290 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.