RTF malware analysis — malicious · bd8ced24b1e25ea0

MALICIOUS

RTF

418.8 KB

MD5: b6468785f51ee0c449bcb837c06232bd SHA-1: 52ea24a1d34ec4e5cbf1cd6f114a312ed02fd604 SHA-256: bd8ced24b1e25ea08681003c4b34f9c045c696250728c2129e627a81b15c35b4

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains an embedded OLE object, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be automatically activated upon opening the document. This mechanism is commonly used to execute embedded malware. The file's SHA256 hash is provided as a primary IOC.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000007a.bin` `09c2031774fa9f7f761df632e9900b0bf6b4fd8bd145d61de56d7cab8401b168`	rtf-objdata-decoded	RTF \objdata at offset 0x7A	134113 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.