Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 b3ae3394812ef8fb…

MALICIOUS

RTF / .DOC

22.8 KB
MD5: 979442341ac1d58857627cff3806447c SHA-1: a137ff53e9c6de24348949c4e14c14ce301e6c59 SHA-256: b3ae3394812ef8fb4be1fdc8f917854e2e5af71235422c2f17983bc89d5358a8
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The RTF document contains OLE object data and an \objupdate directive, indicating it's designed to activate embedded objects. While no specific document body content or scripts were extracted for direct analysis of user-facing lures or payload execution, the presence of these RTF-specific malicious indicators suggests an attempt to exploit OLE object handling for delivering a secondary payload.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000015df.bin
47c7df39089aed9eb219b582acd896043fd44bb0daf5bc43696d59b755b24aa5
rtf-objdata-decoded RTF \objdata at offset 0x15DF 2395 bytes