RTF malware analysis — malicious · dc88a47d95365584

MALICIOUS

RTF

27.6 KB First seen: 2023-07-27

MD5: 4f6911ba2cfb8db577523bafa3d70a78 SHA-1: 84e8b61829ad0651f8e5aeb915155c9886e8e750 SHA-256: dc88a47d95365584d798ca8e9f5e9129f36449dfde325acb1cba1a9de613fe4f

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this embedded object is designed to be activated, which can lead to arbitrary code execution. The embedded object, objdata_00_off00001b8e.bin, is likely a malicious payload. The attack pattern involves tricking the user into opening the RTF file, which then triggers the execution of the embedded object.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001b8e.bin` `5c673832885d526ca76bb3ebf658e9d4259dbc9d60101af2adc3cdac1913783d`	rtf-objdata-decoded	RTF \objdata at offset 0x1B8E	4174 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.