RTF / .DOC malware analysis — malicious · 9dca31f525b8c6c2

MALICIOUS

RTF / .DOC

375.3 KB

MD5: 161a8ee111bf3382b0d96a29ddf9409d SHA-1: a64d79e74759d5a1e124f6995a26357135035ad8 SHA-256: 9dca31f525b8c6c23aa006d00ee7667792ff9febb8d434c22515771c7cd4af91

180 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution T1566.001 Phishing: Spearphishing Attachment

The RTF document contains multiple OLE object-related heuristics, including automatic linking and updates, indicating it's designed to execute embedded content. The document body explicitly instructs the user to 'download the document and click Enable Editing', a common lure for macro-based malware delivery. No specific malware family was identified, and no direct IOCs like URLs or hashes were extracted from the provided evidence.

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000965.bin` `b6118bc7745db1085e4aa7ee65790ea05d65afa9b344b90a6d0346bf48d05531`	rtf-objdata-decoded	RTF \objdata at offset 0x965	79788 bytes
`objdata_01_off00007114.bin` `06a056ece22876d300a1edc2e8fbd0ce1ee7ba72243ef6d0aa1924e337bd6680`	rtf-objdata-decoded	RTF \objdata at offset 0x7114	79761 bytes
`objdata_02_off0002f9c3.bin` `a8e170497da15decc11753d202c99c86f7a7ffd2d52481e6b9c79a5403675379`	rtf-objdata-decoded	RTF \objdata at offset 0x2F9C3	2632 bytes
`objdata_03_off00030f66.bin` `e8d4fe950caed6dcfde26f4b616825bbe11b93458425974b7d075167f675abf7`	rtf-objdata-decoded	RTF \objdata at offset 0x30F66	12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.