RTF malware analysis — malicious · cb41e7a822c92e38

MALICIOUS

RTF

414.7 KB First seen: 2024-06-11

MD5: 699e5528b3c511cc6caea58d5582e61a SHA-1: 14791bbb4bdbe3fa25be286d9011ed61b56ae109 SHA-256: cb41e7a822c92e38f090d90807f57bb1bf68c347fdbc34abd8a8df53eae4eb33

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

The RTF file contains OLE object data and an \objupdate directive, indicating it's designed to activate embedded objects. The document body provides a lure, instructing the user to 'Enable editing' to bypass security, a common tactic for malware droppers. The presence of these elements suggests the file is intended to exploit user interaction to download and execute a secondary payload.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000157db.bin` `1bff080d7155aeb510460eab558d2edeb0c065149cefa09b9687fd5b768a5a56`	rtf-objdata-decoded	RTF \objdata at offset 0x157DB	1668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.