Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 b5f1e69c98f794e1…

MALICIOUS

RTF / .DOC

13.7 KB
MD5: ce6938ad7d7745eb04f5328bf301e262 SHA-1: 4757f4cb5089f9c6e070a186b9cccc3607035e1d SHA-256: b5f1e69c98f794e102853b14721bc8befcadc25c88d9d6bb54fed4685010a6f4
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document containing OLE object data, as indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic at offset 0xCBF suggests that the embedded OLE object is configured to automatically activate, which is a common technique for exploiting vulnerabilities or delivering malicious content. While no specific script was extracted, the presence of OLE object data and the update trigger strongly implies an attempt to execute embedded code or trigger a download. The confidence is moderate due to the lack of explicit script content to confirm the exact payload delivery mechanism.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000cfb.bin
91d2af9c402d0831aff881ca7591e77c93029bd858fe7c770f3a4ef90a034ae9		 rtf-objdata-decoded RTF \objdata at offset 0xCFB 1756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.