RTF malware analysis — malicious · a887cfb81844497f

MALICIOUS

RTF

192.6 KB First seen: 2024-07-03

MD5: 9904916ce3549610216e99d83e7e2135 SHA-1: d5eefab14ee9d5afa6258d3b399b46f779a56901 SHA-256: a887cfb81844497f8f88e558289f89d8edb3f277f142df636f5267cc8263d198

100 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking

The sample is an RTF document that leverages OLE object data and activation ( RTF_OBJDATA, RTF_OBJUPDATE) to execute embedded content. The presence of the Ole10Native stream further indicates the embedding of an executable object. While no specific malware family is identified, the technique suggests a downloader or initial execution vector.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001ae1.bin` `7d4095ba28c2706fc33daf6ab9c742bc4dd76acdfebd6a81e06e0380585f7004`	rtf-objdata-decoded	RTF \objdata at offset 0x1AE1	4187 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.