RTF malware analysis — malicious · e1d53337cb47ec2c

MALICIOUS

RTF

225.8 KB Created: 2021-02-12 04:30:00

MD5: fe3d9cffe4642022467c093af234d16d SHA-1: 4d2b4668077ab58e8648e725ba84ea28e73a21d5 SHA-256: e1d53337cb47ec2c672320295db1a98dd605bf5fc5251eb521f74ee5a9a63d19

82 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE objects, with a high-confidence heuristic indicating that \objupdate forces OLE activation. This suggests the file is designed to exploit OLE object vulnerabilities for execution. The document body, while appearing as a benign list, is likely a lure to disguise the malicious embedded content. No scripts were extracted, and the benign URL does not contribute to the maliciousness.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000106.bin` `2bc0f0df123199926df55816b5f60e345730389109ec9d4d3e1e52fae51d8783`	rtf-objdata-decoded	RTF \objdata at offset 0x106	267 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.