RTF malware analysis — malicious · c80e339a9fa4c966

MALICIOUS

RTF

217.8 KB First seen: 2022-04-11

MD5: 7abd819dbc8099e0c8802a7c6de1ff3d SHA-1: 0186b0800b0e041168d992d51d9ef55b329c7ea5 SHA-256: c80e339a9fa4c9662d022d8fc93f5dd08ed666ec0ed66a794003a425346b7e24

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204 User Execution T1204.002 Malicious File

The RTF document contains embedded OLE objects and uses a lure to trick the user into enabling content, which is a common method for malware droppers. The embedded objects, identified as objdata_00_off0000095d.bin, objdata_01_off00008903.bin, and objdata_02_off00009ea6.bin, are likely payloads or components of the malicious activity. The document body explicitly instructs the user to 'download the document and click Enable Editing', reinforcing the social engineering aspect.

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000095d.bin` `a595dce45d8e3ac4b0dcbd050343f24d74408531a5bd39f25f4de1f4ce532751`	rtf-objdata-decoded	RTF \objdata at offset 0x95D	15635 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`objdata_01_off00008903.bin` `64b1f15a0e9494bf93ea2a1e9ea1b7d807d3f377db217eed0f95ae662942e168`	rtf-objdata-decoded	RTF \objdata at offset 0x8903	2632 bytes
`objdata_02_off00009ea6.bin` `44deae4627fee3c44f54d5bd10477ec2e17f4c08135f08e2417832e36d10d037`	rtf-objdata-decoded	RTF \objdata at offset 0x9EA6	12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.