Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 ad53b35a6406caec…

MALICIOUS

RTF / .DOC

130.9 KB
MD5: 26af329e9e4eda3a710bdf606b250563 SHA-1: fe190d919035c1b6a646fcd9fb6a874d83bf885d SHA-256: ad53b35a6406caece66540a91f28a7e2505ab3ccbe2a67c5e0f2c1e0b42098f0
80 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The sample is an RTF document that leverages OLE object embedding and activation, indicated by the RTF_OBJDATA, RTF_OBJEMB, and RTF_OBJUPDATE heuristic firings. The RTF_OBJUPDATE rule specifically suggests that the embedded object is designed to be activated automatically, which is a common technique for executing malicious code. The document body is heavily obfuscated and does not provide clear textual clues about its intent. Therefore, the primary attack vector appears to be the exploitation of RTF object handling to achieve code execution, likely for a follow-on download and execution stage.

Heuristics 3

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001600.bin
9f17417932359be469e8e3afa7cd5fd6f4724e9045095d61e4bc2c4f80353dda		 rtf-objdata-decoded RTF \objdata at offset 0x1600 4694 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.