Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 d8a5da9f78085465…

MALICIOUS

RTF / .DOC

9.7 KB First seen: 2022-12-09
MD5: 8f7574acf0737fc12d5019b19df45ff5 SHA-1: 12be20df9be6591cd53003cc4c9e7388a672e41c SHA-256: d8a5da9f780854652a37a5a4fdd812a99af1b26236adf4deac2ca38415224a8d
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The RTF document contains embedded OLE object data and triggers OLE activation via \objupdate, indicating an attempt to execute embedded content. While no specific script was extracted, the presence of OLE objects strongly suggests a downloader or exploit delivery mechanism. The confidence is moderate due to the lack of directly executable script content.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001a98.bin
18b8e17713759377cf8cb6976b6da3ab4597f0364483229ca0adc95f7a674cff
rtf-objdata-decoded RTF \objdata at offset 0x1A98 1510 bytes