RTF malware analysis — malicious · dd25bc697a9aad7c

MALICIOUS

RTF

25.7 KB First seen: 2023-06-12

MD5: 18de0cc6af559b80698181bce1ab907b SHA-1: 0f6a2c4bf38d18dab312bfa2693456eee9a22f53 SHA-256: dd25bc697a9aad7c792ffd9f16336da1d59f7cb6c86dcec38dc41222d5467db9

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data and uses an \objupdate directive, indicating an attempt to automatically activate and execute embedded content. This is a common technique for delivering malicious payloads, often through spearphishing attachments. The specific nature of the payload could not be determined due to the lack of script content and the obfuscated document body.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000013ca.bin` `0e97622a1408bf55211a73330e8ba74742452181292a7634bf7d75b6ad8c8a25`	rtf-objdata-decoded	RTF \objdata at offset 0x13CA	4199 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.