RTF malware analysis — malicious · ddacbaca3be4a7d7

MALICIOUS

RTF

452.7 KB Created: 2021-07-30 23:08:00

MD5: 51ba9fa215e2ef689ab370011538a963 SHA-1: b25c69c0f419c88b61f70944cef9e5d1cdc1af17 SHA-256: ddacbaca3be4a7d723cd6acea1197e74df0cc1090479a0008dc26956c1bdac06

190 Risk Score

Malware Insights

MITRE ATT&CK

T1559.001 Component Object Model Hijacking

The RTF file contains OLE object data and is configured to automatically update and activate these objects, indicating an attempt to exploit vulnerabilities associated with OLE object handling. The presence of ".bin" file suggests that a secondary payload was likely embedded and decoded from the OLE object data. No document body or scripts were extracted, limiting further analysis of the specific payload.

Heuristics 5

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000078f1.bin` `a2e3a686aebbd1433bc00a6d4aefe97fcdefe06aec62765bc01218e5caeadcef`	rtf-objdata-decoded	RTF \objdata at offset 0x78F1	75963 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.79, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.