RTF malware analysis — malicious · cf374f8a76a3ffff

MALICIOUS

RTF

92.9 KB First seen: 2025-04-11

MD5: 6a8ca8f615f0a5a3188e306c64eda3a9 SHA-1: e1e95fdd11a8e7b91cb501cfa8a9d162d2089562 SHA-256: cf374f8a76a3ffffdb3e6a853e06402172241e65ab5ad683705cd6add0d10336

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The RTF file contains OLE object data and triggers automatic updates and activation, indicating it's designed to execute embedded content. The heuristics strongly suggest exploitation of OLE object vulnerabilities for code execution. While no specific payload or second-stage URL was directly extracted, the mechanism points towards a downloader or initial access vector.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001ab8.bin` `fe830f429a6843c2736585fd1962dde033f35dbbdb3ebae2208fd4bb68b4c61f`	rtf-objdata-decoded	RTF \objdata at offset 0x1AB8	4188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.