RTF malware analysis — malicious · a739f22b862af762

MALICIOUS

RTF

449.6 KB Created: 2021-07-30 23:08:00

MD5: ab394103f497d278f9896edc7c46e392 SHA-1: 3006e3559ae8b76558980343927cf2a241cdf099 SHA-256: a739f22b862af76212eb467cf08924e5e9f828dbe42e4a177c33df6f0560d094

190 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The RTF file contains OLE object data and an automatically linked OLE object that is updated, suggesting an embedded malicious component. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document's intent to trick the user into opening a password-protected archive, which is a common tactic to bypass gateway security. The embedded artifact 'objdata_00_off000078f1.bin' is likely the payload or a component thereof.

Heuristics 6

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000078f1.bin` `1b620e6b454fcdbda29a3776e7f91aac914bd0f82c7bdde936cf2fdfa118f353`	rtf-objdata-decoded	RTF \objdata at offset 0x78F1	75233 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.79, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.