RTF malware analysis — malicious · 9b6c516247d99c42

MALICIOUS

RTF

292.6 KB First seen: 2020-06-01

MD5: 173e3689fc84792a71d7707266c66013 SHA-1: cf77ec6b451eef56c229c230c27471097c099c95 SHA-256: 9b6c516247d99c425f524db25c30491555c36e97e4c3ea3150b11bfc04cfe085

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains an embedded OLE object that is forced to activate via \objupdate. This indicates an attempt to exploit a vulnerability for client execution. The presence of OLE object data and the activation mechanism strongly suggest a malicious document, likely delivered as a spearphishing attachment. No specific family could be identified.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000003c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C	79408 bytes
SHA-256: `e7df07da4738a85f67d6fb72ed269821a0dcac808aa9e709b0794a58c60fd9fe`

Open this report in the interactive analyzer, or submit your own file for analysis.