Malicious RTF — malware analysis report

Static analysis result for SHA-256 b4dd393442293ccd…

MALICIOUS

RTF

979.4 KB
MD5: b94c972cbe33fce43d88e3ff8beaae90 SHA-1: e90d813bf65f5ff253beb6c35d4114ee1929bd0d SHA-256: b4dd393442293ccd4d93ed17ff631245b307f9397157a143be6ffafc434568f1
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File T1027 Obfuscated Files or Information

The RTF file contains embedded OLE objects, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE and RTF_OBJAUTLINK heuristics suggest that these objects are designed to be automatically activated and updated, which is a common technique for exploiting vulnerabilities. The extracted artifact 'objdata_00_off000019ed.bin' is likely the payload or exploit code. No document body text or scripts were extracted to provide further context on the specific lure or payload execution.

Heuristics 4

  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000019ed.bin
725391218620eb15218d5916c54a51b6703c4b76d90c34057c12773be1c47254
rtf-objdata-decoded RTF \objdata at offset 0x19ED 498128 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.