RTF / .DOC malware analysis — malicious · d229205721f4e370

MALICIOUS

RTF / .DOC

1.82 MB First seen: 2023-08-24

MD5: 91645e84d9381f464139a5576571c200 SHA-1: 0a52321932a43c9e8a6340fdd509427916c55a36 SHA-256: d229205721f4e3705931761cadb87d1235bcfa2d47993ec4d8bbd6e330a8db54

142 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. High-severity heuristics like RTF_OBJAUTLINK and RTF_OBJUPDATE suggest that the embedded object is designed to be automatically activated and updated, likely to execute malicious code. The presence of a large amount of hex-encoded data within the OLE object, flagged by RTF_EXCESSIVE_HEX, further supports the hypothesis that it hides a payload. The extracted artifact objdata_00_off0000008d.bin is likely the decoded payload.

Heuristics 5

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1910KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000008d.bin` `4f1e5c13c12585bc9070bd13eae1e7e51058bae342db358b86cec13229154977`	rtf-objdata-decoded	RTF \objdata at offset 0x8D	955498 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 8.00, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.