Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 a8196ab66a7b64f2…

MALICIOUS

RTF / .DOC

12.4 KB
MD5: 8b033f069ddd561fc8b68ba9af11d4a3 SHA-1: c31b492acc58e06cf036ca0269774e9e98104d0b SHA-256: a8196ab66a7b64f2c527a7aa748dd4776b285c523b2facf748581c99c2d54998
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and triggers an \objupdate event, indicating an attempt to exploit OLE object handling vulnerabilities. This suggests the file is designed to execute embedded malicious content when opened. No specific malware family could be identified from the available evidence.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000005ea.bin
6c6a7c5fbf32bf78149310f44088e9f0fffb2740dfd60a64697047608124afa6
rtf-objdata-decoded RTF \objdata at offset 0x5EA 1667 bytes