Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 ccd9ed93cd256eb7…

MALICIOUS

RTF / .DOC

15.0 KB
MD5: 1c526607205dae00fbf99fc843d8dd6a SHA-1: 7ad12e23a4be99db16c21b70d39f6aee189702d4 SHA-256: ccd9ed93cd256eb7052d1b83a76159ba8b22b33fd718f7ed09bdcbaa33f41e6a
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and an \objupdate directive, indicating it is designed to exploit OLE activation mechanisms. This suggests a malicious intent to execute embedded code or trigger a secondary payload upon opening. No specific family could be identified due to the lack of script content or further indicators.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000ed5.bin
65bfae3210225237836ea6db9c9ee31154dd4b6828f1057bc0413ac99ae24ef5
rtf-objdata-decoded RTF \objdata at offset 0xED5 1888 bytes