RTF malware analysis — malicious · b14dc9d35254a4a0

MALICIOUS

RTF

30.6 KB First seen: 2020-02-04

MD5: 2c7d3d31635e6ef7af7f5b8b79879bf3 SHA-1: a1ab26f0b4bb42f188740dd108a0cf1b8eadbda6 SHA-256: b14dc9d35254a4a0f0e85e5bd0a7ab4a28bcce49510689b87c4dc33f83b92f17

140 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains high-severity heuristics indicating the presence of OLE objects that are automatically linked and updated. These objects likely contain a URL moniker designed to download and execute a secondary payload, a common technique for initial execution of malware. The specific URL is obfuscated but the presence of the moniker is a strong indicator of malicious intent.

Heuristics 4

URL Moniker in RTF OLE object high CVE related RTF_URL_MONIKER_RELATED

RTF contains a URL Moniker GUID in OLE object context, but no decoded remote target was confirmed. Treat as related OLE2Link attack-surface evidence rather than proof of CVE-2017-0199 exploitation.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000546a.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x546A	3306 bytes
SHA-256: `d77723032808a68da040380e21861ad60b8913c7f0012106b9730ca6bd4dd37f`

Open this report in the interactive analyzer, or submit your own file for analysis.