RTF malware analysis — malicious · 95561a116a974f1f

MALICIOUS

RTF

6.1 KB First seen: 2022-03-15

MD5: c523118e2167bc4709218ce81810f14a SHA-1: 4d1231c50ab48b5eedf3fb08a9d04467f781b66c SHA-256: 95561a116a974f1f494dde96adf5ab4bc2611f00b0e111fb5643ea17f10a99c8

135 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains OLE object data that is automatically linked and updated, indicating an attempt to exploit vulnerabilities associated with OLE object activation. The presence of an embedded URL, though benign, suggests a delivery mechanism. The heuristics strongly point towards exploitation of OLE object vulnerabilities within the RTF document.

Heuristics 4

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000200.bin` `49b37eddd7a3f1efe1aabb4b3aeca2834109ad17b58a5381e60a23fa9d25a69c`	rtf-objdata-decoded	RTF \objdata at offset 0x200	2668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.