RTF malware analysis — malicious · b1341fb2235ba73b

MALICIOUS

RTF

13.6 KB

MD5: 2588cb56a4d1f28e05f0dc5d60e7ce2f SHA-1: 2f9d0772692a2412c2c8d313be28f4007127c054 SHA-256: b1341fb2235ba73b6ec571b58c6967eb0b8aaffa462e49c29a9595be8073d533

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The RTF document contains OLE object data and is configured to automatically update and activate these objects. This suggests an attempt to exploit the OLE object handling to execute arbitrary code. While no specific script was extracted, the heuristics strongly indicate a malicious OLE object is embedded. The attack pattern is likely a lure to trick the user into activating the embedded object, leading to further malicious activity.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001ebf.bin` `e2168dd86af85bc54fad28ebd3fb7b4c0e83ff9b98951983f7954b90c11e56e8`	rtf-objdata-decoded	RTF \objdata at offset 0x1EBF	2249 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.