RTF malware analysis — malicious · dc55e4e490b28f33

MALICIOUS

RTF

3.3 KB First seen: 2022-09-23

MD5: ccf05d2a6cf6e315c26346aa543c4141 SHA-1: 69f44fda9230a57b57cbad25aed366bd011b920a SHA-256: dc55e4e490b28f3385ec7237e719ec90b369869b0b0e67a8219d50b76cea9d3d

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and an \objupdate directive, indicating it is designed to exploit OLE object activation vulnerabilities. This is a common technique for delivering malicious payloads. No specific family could be identified from the available evidence.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000072.bin` `2ca8ed1d7789cc968bbdb1be51affff76ec6cbeb74ee9076c7c72ada9cdc3b1a`	rtf-objdata-decoded	RTF \objdata at offset 0x72	1594 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.