RTF malware analysis — malicious · d9cf1187daa3ccdf

MALICIOUS

RTF

463.4 KB First seen: 2022-12-01

MD5: 97d6f740a03617a3228dc9cfeb49e5bc SHA-1: db207cb96a559f525a9dc5e04693ed7c7aa0d3b8 SHA-256: d9cf1187daa3ccdf450cc4c48ce479e2a99df95468573baf8277c68ab678fcbd

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be activated, likely leading to the execution of embedded code. This pattern is commonly used to deliver secondary payloads, making it a high-confidence indicator of a malicious document.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000007fd.bin` `fcaaca7e320565ebd5ef29bbde228f456e49650eb898069ddc1c499e23083157`	rtf-objdata-decoded	RTF \objdata at offset 0x7FD	2102 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.