RTF malware analysis — malicious · b25f3db74d63d42e

MALICIOUS

RTF

3.8 KB

MD5: bf14de851cd1dca5ebfe66219d8e6682 SHA-1: 96fa5b7b734d13112acd540e17d688ee3211a41f SHA-256: b25f3db74d63d42e8cf1c5224ec5b1097036e4ee3339c961d0bf681506dad883

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this embedded object is designed to be automatically activated upon opening the document, likely exploiting a vulnerability to execute arbitrary code. The specific nature of the exploit and its payload cannot be determined from the provided evidence.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000083.bin` `e3c2f1ae5c1d5c0256df928813df3df451745d516b42924b32e2ccf06aa3eaec`	rtf-objdata-decoded	RTF \objdata at offset 0x83	1877 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.