RTF malware analysis — malicious · b908b21d31a75802

MALICIOUS

RTF

3.4 KB First seen: 2022-11-23

MD5: a83bc314cafe6d1cfc67ad6d9b851392 SHA-1: 6b9b33a90be84ce086e2a7849d5d8adc37990c0e SHA-256: b908b21d31a75802b1361a852c57baea8636c101685f736460bafc918a7415c0

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and an \objupdate directive, indicating it is designed to trigger the activation of embedded objects. This is a common technique for delivering exploits or launching malicious payloads upon opening the document. The specific exploit targeted is not identifiable from the provided heuristics.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000007d.bin` `83db0c09b3d990613e42c9fb4f6b0f63a330b5187afd258c016e71f2131c904a`	rtf-objdata-decoded	RTF \objdata at offset 0x7D	1610 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.