RTF malware analysis — malicious · d25624c26e85dccb

MALICIOUS

RTF

612.3 KB First seen: 2024-07-24

MD5: 0b98de8b03f4f26b25888b58c19dcaab SHA-1: dcb036ae76f9a236383f1192d94eb7c6c6fa3bd2 SHA-256: d25624c26e85dccb4512e601ede7c1617e41b3aa26cc50649123e3ef04ad3071

100 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

The RTF file contains embedded OLE objects and uses an \objupdate directive, indicating an attempt to automatically activate embedded content. The document body provides a lure related to financial audits, instructing the user to 'Enable editing', which is a common tactic to bypass security measures and execute malicious payloads. No specific scripts or URLs were extracted, but the heuristics strongly suggest a dropper or exploit delivery mechanism.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000410f1.bin` `2f18a6161ba9936a5216a73022e07b76ac774ce55b5e5f607cfe4dc2d7939789`	rtf-objdata-decoded	RTF \objdata at offset 0x410F1	1631 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.