RTF malware analysis — malicious · 9aa969e5d815f4a7

MALICIOUS

RTF

22.9 KB

MD5: 2137a5a55ef05911b840631754c6141a SHA-1: b18b59d514616dceee452ccfe589322b8013500b SHA-256: 9aa969e5d815f4a7e65b840870a1ebef9a4fbc6c9b7a67983d68a8d240229d6b

140 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE objects that are automatically linked and updated, indicating an attempt to execute embedded content. The presence of RTF_OBJDATA, RTF_OBJUPDATE, and RTF_OLE10NATIVE_STREAM heuristics strongly suggests that the file is designed to exploit OLE object activation to deliver a malicious payload. The document body is heavily obfuscated and does not provide clear textual clues about the specific lure.

Heuristics 4

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000fb5.bin` `e851788cdfdbb0cda8be96de633b1a5a125211625cc8181baca0b706f51a9a10`	rtf-objdata-decoded	RTF \objdata at offset 0xFB5	4173 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.