RTF malware analysis — malicious · b60afd598ce4ff2f

MALICIOUS

RTF

225.3 KB Created: 2021-02-12 04:30:00

MD5: b55cab3d9b98ac2bdb7d09677960d478 SHA-1: e1df67e3f8141a2d2038f7f8d59cfb98ca5f1575 SHA-256: b60afd598ce4ff2fc881f3afb62b12ee8093bb6d5851f4469d7a71db644037a4

82 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and uses \objupdate to force OLE activation, indicating an attempt to exploit a client-side vulnerability for code execution. The presence of an embedded OLE object suggests the file is likely a malicious attachment delivered via spearphishing. No specific family could be identified.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000106.bin` `cc426da46906a334ca62f0d8e35529f4ab15a66f8f9f21734d3ff3b8c2c634c8`	rtf-objdata-decoded	RTF \objdata at offset 0x106	1277 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.