RTF / .DOC malware analysis — malicious · d8dca1637184327f

MALICIOUS

RTF / .DOC

1.93 MB

MD5: 9c245d978c53949241e96b53f565a9a0 SHA-1: 3859c7450179c4d7ec7f7fc8f5d161f1674f886d SHA-256: d8dca1637184327ff59dfebda5b0cbc210a7f9c8d5c88c167a527a896003909d

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains multiple embedded OLE objects, with one specifically triggered by \objupdate, indicating an attempt to execute embedded code. The extracted script content, although partially obfuscated, contains references to 'wscript.exe' and 'shell.exe', suggesting it attempts to download and execute a second-stage payload. The presence of embedded OLE objects and the script's execution intent strongly point towards a malicious document designed for payload delivery.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000b2b.bin` `704481d306f840f90bbbbde37c21c6194e90679179faa288ca50aa8f0b7e0572`	rtf-objdata-decoded	RTF \objdata at offset 0xB2B	7384 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`objdata_01_off00004e5b.bin` `44eb1fd26b9b589c2f535750285b6140650e94baa38bb4ec763dcc0c19a8c666`	rtf-objdata-decoded	RTF \objdata at offset 0x4E5B	126 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`objdata_02_off00005d2d.bin` `d7c7498c38be6ae358e3abe759973a2a120f0d9d4b41fe055f4235c1dab1a56a`	rtf-objdata-decoded	RTF \objdata at offset 0x5D2D	475446 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.