RTF malware analysis — malicious · b7bcca505bb4c01e

MALICIOUS

RTF

537.1 KB First seen: 2024-12-08

MD5: e4600600fdb5ea765e9c17d3a46950d8 SHA-1: 56e83b255c7921af0729f1d1314416c10dd97fe4 SHA-256: b7bcca505bb4c01e931677cc34085be7c7d1a25bd42e2b1eeb1f8fb24769cce3

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing via Service

The RTF file contains OLE object data and an \objupdate directive, indicating it's designed to activate embedded objects. The document body text provides a lure about financial audits, instructing the user to 'Enable editing', a common tactic to bypass security measures and facilitate the execution of malicious content. The presence of these elements suggests the file is a dropper designed to download and execute a secondary payload.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0002f6a5.bin` `411112bfe8b75acbb3a706716bc76a73dfead4bb65177a3625dadbb5a00fe095`	rtf-objdata-decoded	RTF \objdata at offset 0x2F6A5	1928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.