RTF malware analysis — malicious · 985e9cabf64b62b1

MALICIOUS

RTF

24.1 KB First seen: 2023-06-13

MD5: 0cb711fdef6f0d33c61dcd0974bd64ce SHA-1: b3daa176db4853c90b685b4015101cd20e27764b SHA-256: 985e9cabf64b62b1913aafb1f3e75fe8ef0a2d29069e66fc2961a6e63a15c15e

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this embedded object is designed to be activated, likely leading to the execution of malicious code. The presence of OLE object data is a common technique for delivering exploits or malware payloads within documents.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000e09.bin` `a7aab19c22c508d92974d731af7a619e4ab0c35df69cc4fe756e6e602a59639f`	rtf-objdata-decoded	RTF \objdata at offset 0xE09	4184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.