RTF malware analysis — malicious · d9f45cf5b8a54b55

MALICIOUS

RTF

24.1 KB First seen: 2023-05-11

MD5: f908218ac1828a12fb1972d54fddf1ec SHA-1: b21bbb11e7f447ab2574bfee6201523a67a49de7 SHA-256: d9f45cf5b8a54b55765870fca2f047b822f44eb90f1b47190133f7b96ad4b51b

100 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking

The sample is an RTF file exhibiting high-severity heuristics for OLE object data and automatic linking, indicating it embeds and attempts to activate external content. The ".objupdate" directive further suggests an attempt to force activation of this embedded object. While no specific payload or URL was directly extracted, the OLE object activation is a common technique for delivering secondary-stage malware.

Heuristics 3

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001787.bin` `edcd8ff7417bc922278244e69a5ce18d60f15825278db2ffccc06d8db2be59b3`	rtf-objdata-decoded	RTF \objdata at offset 0x1787	3672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.