RTF malware analysis — malicious · d487bd4474e2fb3a

MALICIOUS

RTF

56.3 KB First seen: 2018-06-14

MD5: 0e4d9da9edabdc4bca79a539dca27943 SHA-1: eaf84ac2cb8a4c3f2281f69eb08d1577fba12c00 SHA-256: d487bd4474e2fb3a649418b4a45a45b5d02b482a32ee856ce143098a70bbc7ec

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and uses the \objupdate directive, indicating an attempt to exploit OLE activation for code execution. The presence of these indicators strongly suggests a malicious document designed to deliver a payload. As no specific family indicators were found, it is classified as an unknown family.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000cfa.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xCFA	13822 bytes
SHA-256: `059c403b870c8eabf0967c98353be294faec69babc5d45c97804585f28c77828`

Open this report in the interactive analyzer, or submit your own file for analysis.