RTF malware analysis — malicious · c125b9240d1f9d8f

MALICIOUS

RTF

113.1 KB

MD5: 85734d9a58cb275560b357e67ac8240d SHA-1: f37a03c05afb71a4ec7df21b44b641e9333d2248 SHA-256: c125b9240d1f9d8f806784ea9b73475ad5660245a7ad001ad87e0be58f4a1725

80 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE objects, indicated by the RTF_OBJDATA and RTF_OBJEMB heuristics. The RTF_OBJUPDATE heuristic suggests that the embedded object is configured to automatically execute when the document is opened. While no specific script or payload was directly extracted, the OLE activation mechanism strongly implies an attempt to deliver and execute a secondary payload. The document body is heavily obfuscated and does not provide clear textual lures.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000015c8.bin` `9165daf6231b36c096f2e8e4d86e28d1f7bcc0fa3def50efef666a660a1351df`	rtf-objdata-decoded	RTF \objdata at offset 0x15C8	38163 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.