RTF malware analysis — malicious · c45c194119af8c80

MALICIOUS

RTF

362.3 KB

MD5: c48276845cbe6a3d5bf9c3654bc36a71 SHA-1: 26fa15d496a9e890621e0b64a017b6ab1b2ecadc SHA-256: c45c194119af8c80113e249cda43efad040ef469c2e73d8272f20bcf3b5b0731

129 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains OLE object data that is triggered for activation via \objupdate. This suggests the file is designed to exploit a vulnerability or trick the user into activating embedded content. The extracted objdata artifact is suspicious and likely contains the malicious payload. The attack pattern is consistent with a malicious document used for initial access, likely leading to further stages of infection.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001b64.bin` `c43a6a40bcd378b70b780eba22bdc1efc69421659ea526144475a3045351b269`	rtf-objdata-decoded	RTF \objdata at offset 0x1B64	103483 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.97, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.