Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 916b82ec72b04bec…

MALICIOUS

RTF / .DOC

11.2 KB
MD5: 7a61e1f2990ed01daba36a19255a7967 SHA-1: f35678a6116f884a65f8ff77e4c0e4efdd65f792 SHA-256: 916b82ec72b04beca20629129e3401d2f06a76026d12cd3c41fc28b927fbdf83
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The RTF document contains OLE object data and triggers OLE activation, indicating an attempt to execute embedded content. While no specific document body or script content was available for analysis, the heuristic firings strongly suggest a malicious intent to exploit OLE object handling. The exact payload and delivery mechanism remain unclear without further analysis of the OLE object.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001c54.bin
2140054d479e24e23b28e1d6c606110d39a11c0413f888f8faa08745304bc449
rtf-objdata-decoded RTF \objdata at offset 0x1C54 1587 bytes