RTF malware analysis — malicious · 9d483b95136f3daa

MALICIOUS

RTF

24.8 KB First seen: 2023-01-16

MD5: f53e284bae498d64482cd230ca73b0b6 SHA-1: 14a7620d0b23c9e56d87b1f1a1e294d1e59d7d10 SHA-256: 9d483b95136f3daa77fb94176c2141d3460986f275b63404c89c703b4b11e658

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 User Execution: Malicious Link T1566 Phishing

The RTF file contains an OLE object and an \objupdate directive, indicating an attempt to exploit OLE object activation. The document body explicitly instructs the user to 'Enable editing' to view the content, a common social engineering lure for macro-enabled malware. No specific family could be identified, and no executable payloads or network indicators were directly extracted.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00004d90.bin` `5bc46dabd77222a7afde86e65309badbd8ff0654c5fcd97ab89d0261b0ca43dd`	rtf-objdata-decoded	RTF \objdata at offset 0x4D90	1546 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.