Malicious RTF — malware analysis report

Static analysis result for SHA-256 d647acc967d07c81…

MALICIOUS

RTF

2.7 KB First seen: 2019-10-01
MD5: 719c2018203302f57c7141bdd177b472 SHA-1: 0696f5686c72f57268d92a58d9c21d7202c69dcd SHA-256: d647acc967d07c81573f25e313b4ed999a95cfc486901507c442bf439b521a78
60 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains OLE object data and an \objupdate directive, indicating it is designed to exploit OLE object handling vulnerabilities. This technique allows for the execution of arbitrary code when the document is opened. No specific family could be identified from the available evidence.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000006f.bin rtf-objdata-decoded RTF \objdata at offset 0x6F 1315 bytes
SHA-256: 31a964549f512b796dc3eec8baa98bbc3b08541216eccfdf794f1a3f3a6e5960

Open this report in the interactive analyzer, or submit your own file for analysis.