RTF malware analysis — malicious · bc5eb6c736a26be7

MALICIOUS

RTF

96.2 KB First seen: 2025-08-07

MD5: a24f990ffc5cd4d0e3432a0ed6cee54b SHA-1: 1e2bba7835aa0c01e4f7c769d2ed7173675ddc88 SHA-256: bc5eb6c736a26be771c74b3bdd25c59b3e44f3c87d4498920e0d5b32edf7ac1e

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File T1027 Obfuscated Files or Information

The RTF file contains OLE objects that are automatically linked and updated, indicating an attempt to exploit OLE activation mechanisms. The presence of `RTF_OBJDATA`, `RTF_OBJAUTLINK`, and `RTF_OBJUPDATE` heuristics strongly suggests that the embedded OLE object is designed to be activated upon opening the document. This is a common technique for delivering secondary payloads, although no specific payload or download URL was directly extracted from this sample.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001390.bin` `4322939356bcb78be21cc57ee8440e873c38cd8554a517c55e64ba3f8ad1a5c6`	rtf-objdata-decoded	RTF \objdata at offset 0x1390	4249 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.