RTF malware analysis — malicious · a7aae83573aa9a68

MALICIOUS

RTF

385.9 KB First seen: 2019-03-18

MD5: 02b6f049f4d8246ee982d8c34a160311 SHA-1: 088ed5abd0edda72a846ddcec24fceeafe394188 SHA-256: a7aae83573aa9a682ce9733468882e841564f41ec4aa004cb795b98fd4834d15

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and an \objupdate directive, indicating an attempt to exploit a vulnerability and activate embedded content. The high heuristic scores for RTF_OBJDATA and RTF_OLE10NATIVE_STREAM confirm the presence of an embedded OLE object. While the document body is heavily obfuscated and unreadable, the structure strongly suggests the file is designed to deliver and execute a secondary payload, likely via an embedded OLE object exploit.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000004c2.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4C2	117091 bytes
SHA-256: `4f7ca3d7f2790e82fd79d8d038621fbb56f729e1aca5653aeb4f63e9bc17dd1c`

Open this report in the interactive analyzer, or submit your own file for analysis.