RTF malware analysis — malicious · 92740ddbc400e9bd

MALICIOUS

RTF

3.2 KB First seen: 2023-07-27

MD5: 953a2225be0e882be22397cf310a6854 SHA-1: 56d5a277cd067f33ee107eb0bb71e12a562db526 SHA-256: 92740ddbc400e9bd8f0ba7cb762dd0766dad9a90333a2b0d32f53d61ea270aa7

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this embedded object is designed to be automatically activated upon opening the document, likely exploiting a vulnerability to execute arbitrary code. No specific family is identifiable from the provided evidence.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000091.bin` `f461f48c747f69e38fb2bc17b15920a17aa24a3de2f4169ddc3f75c82e308df1`	rtf-objdata-decoded	RTF \objdata at offset 0x91	1500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.