RTF malware analysis — malicious · b068a6b288950004

MALICIOUS

RTF

20.1 KB First seen: 2023-05-30

MD5: e4ca6a35d8419838d19df794b67b0548 SHA-1: be3d428c23538fdfc91b71a92855b6cd880513ea SHA-256: b068a6b2889500047781df72d19ff86d90b02c92f1f57bc1b0a5f6f774665fcb

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and a \objupdate directive, indicating an attempt to exploit OLE object activation. This suggests the file is designed to deliver a malicious payload when opened. No specific malware family could be identified from the available heuristics.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000884.bin` `a42432dae3fa8a19d557ba090ff833848778c164f0ef46806c443df13e4c5440`	rtf-objdata-decoded	RTF \objdata at offset 0x884	3664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.