RTF malware analysis — malicious · d8f45c1ed4eedeaa

MALICIOUS

RTF

16.8 KB First seen: 2018-10-07

MD5: 759ea599bdb4adb2629798715932c17b SHA-1: 057091a5c3b4c8dbf8a7b2aa7d92dcc407e202d1 SHA-256: d8f45c1ed4eedeaa5ce3e49b98f2079707888b38de4c4418b2a5f6c62211021f

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and triggers an \objupdate event, indicating exploitation of a vulnerability to execute embedded code. The presence of RTF_OLE10NATIVE_STREAM further confirms the embedded OLE object. While no specific payload or URL is directly visible, the technique strongly suggests the file is designed to download and execute a secondary stage, characteristic of a malicious attachment.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000cd7.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xCD7	4651 bytes
SHA-256: `e898fd8f3f82c32b8b1941c1d18daa604aa27ab8cdb86cdcc82bcc27e955cc1e`

Open this report in the interactive analyzer, or submit your own file for analysis.