RTF malware analysis — malicious · cb40deef9f675c99

MALICIOUS

RTF

2.8 KB First seen: 2022-12-16

MD5: 12c7cee6a92afaf49acefcf20cb31204 SHA-1: 2597fb59ce4504bc37bd8edbb1590b10ae6a6ef8 SHA-256: cb40deef9f675c99731fe8c9a59659ee2d2993fdb2c403c05a3dc34d27aaec90

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains OLE object data and an \objupdate directive, indicating it is designed to exploit OLE object activation vulnerabilities. This is a common technique for delivering malicious payloads, likely through a social engineering lure such as a phishing email.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000072.bin` `e6a23c65fe79d5662f9e35af87c1342decbdd00d05c63642fc5014f71a5f1f97`	rtf-objdata-decoded	RTF \objdata at offset 0x72	1336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.