RTF malware analysis — malicious · bfc144ed14ca91ff

MALICIOUS

RTF

10.8 KB

MD5: 95f8ff284d42f8cf8ae9b5c95135f344 SHA-1: 675886e219762c23202666bb950915971ff4a60f SHA-256: bfc144ed14ca91ff86ea1b7cb5c5005e93a2324741e6930afc74a7af05feae9a

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The RTF file contains OLE object data and a \objupdate directive, indicating an attempt to exploit OLE activation mechanisms. While no specific script was extracted, the presence of these elements strongly suggests the file is designed to deliver a malicious payload upon opening. The file's SHA256 hash is provided as a primary IOC.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000015ca.bin` `ce534e319a850f09db7a1ada83802fb0ea3160fcb7af8514b7fc49f21d3b5583`	rtf-objdata-decoded	RTF \objdata at offset 0x15CA	2035 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.