RTF malware analysis — malicious · 90acc9e10ce15729

MALICIOUS

RTF

10.9 KB

MD5: 6ded14c9cafeeacfdcd175c32cd91c7b SHA-1: dab8e8c3e4785599cef4530c1d01d9634f6a41f9 SHA-256: 90acc9e10ce15729b2c9b311b37b352fcf01f281f981629dd40301a3af2f366d

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and a \objupdate directive, indicating an attempt to embed and activate external content. This suggests a delivery mechanism for malicious payloads, likely exploiting OLE object handling. Without further script analysis or document body content, the specific family and exact payload remain undetermined.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000197b.bin` `9b70246d0b16aaaabe4c0ec17bd93f56613237ccff09c398cb39b2761ca0fe3c`	rtf-objdata-decoded	RTF \objdata at offset 0x197B	1579 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.