Malicious RTF — malware analysis report

Static analysis result for SHA-256 9d50901887996148…

MALICIOUS

RTF

41.3 KB First seen: 2019-04-18
MD5: 9d4090fde8b8fba5bc6bc3c3d25b4938 SHA-1: c41f4c5cf103b4ac93aff2e6bfb3362b3400b2af SHA-256: 9d509018879961487639e678020a6bd2d3a9e8f0bf7f2a7d51970e8ec684b52d
140 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data that is automatically linked and updated, indicating an attempt to exploit vulnerabilities for client execution. The presence of a URL moniker within the OLE object suggests it is designed to download and execute a payload. The specific URL is heavily obfuscated, but its presence is a key indicator of malicious intent.

Heuristics 4

  • URL Moniker in RTF OLE object high CVE related RTF_URL_MONIKER_RELATED
    RTF contains a URL Moniker GUID in OLE object context, but no decoded remote target was confirmed. Treat as related OLE2Link attack-surface evidence rather than proof of CVE-2017-0199 exploitation.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000546a.bin rtf-objdata-decoded RTF \objdata at offset 0x546A 8661 bytes
SHA-256: ab6dde3d6968d70d4b62808759ebeb5900d6da992c3bb506f3b79e193fd14198

Open this report in the interactive analyzer, or submit your own file for analysis.