Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 a3e7d516e9bc9738…

MALICIOUS

RTF / .DOC

1.35 MB
MD5: 740b51e1a54c208e5c9c83fc3317fc0e SHA-1: e69ad6fc49440e561a14d119937d49e19b23a778 SHA-256: a3e7d516e9bc973851dd727a31c525d8e946df586e528db14cbeee40cfc075d4
80 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and an \objupdate directive, indicating an attempt to activate embedded objects. The document body explicitly instructs the user to 'enable editing', a common lure for macro-based malware delivery. While no specific scripts were extracted, the heuristics strongly suggest a malicious document designed to exploit OLE object activation and user interaction to execute further stages.

Heuristics 3

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000ad9b5.bin
ca3af7e4becfb3e702169120e5e2dbe4d294de5d48f168f04ee1650b5598a0b0
rtf-objdata-decoded RTF \objdata at offset 0xAD9B5 3764 bytes