RTF malware analysis — malicious · 9ec719d948cd09a2

MALICIOUS

RTF

7.6 KB First seen: 2023-07-27

MD5: 4b2667a3c05f28bf22e518e825f79a34 SHA-1: 5bf3f4ba0ae2e0aaca2bf040fce387c3d82c1172 SHA-256: 9ec719d948cd09a2a0efc7863b62cd6bd337c46727e67a9e56b42a6b794d777a

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains OLE object data and an \objupdate directive, indicating an attempt to exploit RTF parsing vulnerabilities. This is commonly used to deliver secondary payloads. While no specific script was extracted, the heuristics strongly suggest a malicious OLE object activation, likely leading to remote code execution.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000a80.bin` `62457c6de3583168cadc1467541d72e551fde74f0b381c7f30ac40a092fb186c`	rtf-objdata-decoded	RTF \objdata at offset 0xA80	2497 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.