RTF malware analysis — malicious · afc4d700c69620f5

MALICIOUS

RTF

4.77 MB

MD5: 58b72fb18e36f26964170187377c6b0a SHA-1: 9d9c1015c83e959e582e6fd36455f243a55c18e8 SHA-256: afc4d700c69620f5d539b358f58ddb053b8bccccd62e3bacb0757b173329b8d7

140 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple high-severity heuristics indicating the presence of embedded OLE objects with excessive hex-encoded data, designed to force OLE activation. This strongly suggests the file is intended to exploit vulnerabilities for client execution, likely delivered as a spearphishing attachment. No specific family could be identified from the available evidence.

Heuristics 4

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~4997KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000d2.bin` `47cf036e9c70c7090bd505bd72cce081f7a4dbee1dc05679d32791efb5f73f10`	rtf-objdata-decoded	RTF \objdata at offset 0xD2	999003 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.