RTF malware analysis — malicious · ce63cb39b115511c

MALICIOUS

RTF

24.1 KB First seen: 2023-05-30

MD5: 454cb4cd20f392c5147c69ecdab428f4 SHA-1: a1cbaa9957202930bb1f853763819cb1cc05c3b3 SHA-256: ce63cb39b115511cd09ae0c7d3f7abb20613b619c963292803082817fabaa00d

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1559.001 Component Object Model Hijacking

The RTF file contains OLE object data and an \objupdate directive, indicating an attempt to exploit OLE activation for malicious purposes. This suggests the file is designed to drop and execute a secondary payload, likely via the embedded OLE object. The specific nature of the payload is not fully discernible from the provided heuristics and truncated document body.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000e24.bin` `233f9532c45fd0e1a809f48d846125979c4c8aed899047286622e917fd61c235`	rtf-objdata-decoded	RTF \objdata at offset 0xE24	4159 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.