Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 a8591435c9a12029…

MALICIOUS

RTF / .DOC

14.0 KB First seen: 2022-08-25
MD5: fbc0ef8a62c3b33a4f6dbd1d0a52b9c8 SHA-1: 960acfd846c3154ead5d2fec7267337837c22112 SHA-256: a8591435c9a12029c0015affe6cdc4e6ce35263c253c1ff46dc0d16e8da02fcf
120 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing via Service

The RTF document contains OLE object data and an ".objupdate" directive, indicating it's designed to activate embedded objects. Heuristics confirm the presence of an Ole10Native stream within an OLE object. The document body includes a lure instructing the user to 'enable editing to view in readable format', a common tactic to bypass macro security and execute malicious content.

Heuristics 4

  • Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM
    RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000a0e.bin
63f633c34b45d32f4f8ea680c53c6abcfe6499b94e17acf69b1600c7a30aedc7
rtf-objdata-decoded RTF \objdata at offset 0xA0E 3740 bytes