RTF malware analysis — malicious · b02820808d2afec6

MALICIOUS

RTF

16.2 KB First seen: 2022-09-29

MD5: 494b22c66c04e44027d33898fc620445 SHA-1: 622d362311960c555a12084352dace4fc9183b0a SHA-256: b02820808d2afec6c8bd57488128518d219d482b1547c34199e3e550e064c4c7

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File Execution: User Execution T1027 Obfuscated Files or Information

The RTF file contains OLE object data and uses \objupdate to force activation, indicating an attempt to execute embedded content. The high entropy of the decoded OLE object suggests it is likely a packed or obfuscated executable. While no specific URLs or scripts were extracted, the structure strongly suggests a downloader or exploit delivery mechanism.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000de9.bin` `0f2b0e10616453a554b0bec2f0d68e4a9eb5916d47bb650791086bf52013830d`	rtf-objdata-decoded	RTF \objdata at offset 0xDE9	3651 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.