RTF malware analysis — malicious · 9c3e592960d98e85

MALICIOUS

RTF

7.9 KB

MD5: ec8a0ccbbaae0218f3027613f6836768 SHA-1: 0aa4453e2e586e050ff978e98358f6e4701be3ea SHA-256: 9c3e592960d98e85b859efbec06c7d1a880b083913b47c9d0fe1dfe4356fb118

80 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.001 PowerShell

The sample is an RTF file containing OLE object data and an embedded OLE object, with a high-confidence heuristic indicating that \objupdate forces OLE activation. This suggests an attempt to exploit a vulnerability within the RTF parsing or OLE object handling to achieve arbitrary code execution. The presence of embedded OLE object data, specifically decoded as 'rtf-objdata-decoded', is the primary indicator of the attack vector. Without further script content or specific URL IOCs, the exact payload delivery mechanism remains unclear, leading to a moderate confidence score.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000d72.bin` `02a8c6b7fec4a25749f0d0cf53dd7704cd5c69fca97d36a9809940742feb7980`	rtf-objdata-decoded	RTF \objdata at offset 0xD72	1657 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.