RTF malware analysis — malicious · a990935a56fc2c4f

MALICIOUS

RTF

22.4 KB

MD5: b3fe48baf5ec636f11eeb68b1528530a SHA-1: 9e59a9e421eedd8e2ea2653925c238fd65544b94 SHA-256: a990935a56fc2c4f5ed1ed4efadbb2e2430212c7dccb1ac96c01a7b4d7307fe2

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The RTF document contains OLE object data and uses \objupdate to force activation, indicating an attempt to exploit OLE vulnerabilities. The presence of the Ole10Native stream further supports this. While no specific document body content or scripts were extracted to detail the exact payload, the heuristics strongly suggest a malicious OLE object is embedded and intended for execution upon opening.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000ee9.bin` `042c131180683a0ddce541eeca883416072be2181640e4f62212b6d7563c43fd`	rtf-objdata-decoded	RTF \objdata at offset 0xEE9	4171 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.