Malicious RTF — malware analysis report

Static analysis result for SHA-256 9906899ad931fe5c…

MALICIOUS

RTF

116.5 KB First seen: 2026-06-18
MD5: ac189655dc7df9f3db4d71dc4f87253e SHA-1: bdb2d8b5372f50812ab592bdea62731fa08d8715 SHA-256: 9906899ad931fe5c9c6e949827d1588c3fb7b2ae05ab6ebfa8b489a510c12c01
60 Risk Score

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001f7e.bin rtf-objdata-decoded RTF \objdata at offset 0x1F7E 4208 bytes
SHA-256: 1729488f84a08222fd6e08bb217e4305d685439e165c8f146a8e4792254df391

Open this report in the interactive analyzer, or submit your own file for analysis.