RTF malware analysis — malicious · d56785bf6b984999

MALICIOUS

RTF

67.7 KB First seen: 2023-08-29

MD5: 31ce177f7ba98d5698c919a0e8cd76f6 SHA-1: 15181f47cdc7ddd912cebb840e25e468d4896029 SHA-256: d56785bf6b9849994d1ed43d44e9d014f8b4a1f82788dee1b671298fc095c603

120 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

The RTF file contains OLE object data and is configured to automatically update and activate OLE objects, indicating an attempt to execute embedded content. The document body provides a lure, instructing the user to 'enable editing' to bypass security measures, a common tactic for malware droppers. The heuristics suggest the file is designed to exploit OLE object functionality to deliver a malicious payload.

Heuristics 4

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002c2c.bin` `c5e78cc77ac32911b3c590c2fbaa1b59d7ca84af8579a43d8c85fede496e3c92`	rtf-objdata-decoded	RTF \objdata at offset 0x2C2C	4171 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.