Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 dc205ed9f348567e…

MALICIOUS

RTF / .DOC

18.2 KB First seen: 2021-09-17
MD5: 128db0bf36c23b32f23099547d621997 SHA-1: 0c6096deea4b56b1f037299ee44cdd97c574f0fe SHA-256: dc205ed9f348567ea17204684488c7a78933eb3b9896d840c6115016467b6622
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The RTF document contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be activated, likely leading to the execution of malicious code. No specific family could be identified, and the document body was not sufficiently readable to determine the exact lure.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000114b.bin
6da6991d0361cd0d272c6bf758f021df2be005927068f9fba2daf544d4a3711e
rtf-objdata-decoded RTF \objdata at offset 0x114B 1646 bytes