RTF malware analysis — malicious · e499cb308869d8cd

MALICIOUS

RTF

920.5 KB First seen: 2023-05-18

MD5: 8d365cbdbbd23861dfadd8778fdd7160 SHA-1: a880d78f48f1a04114e33b28a3fa30462e625e00 SHA-256: e499cb308869d8cdcb6cbed33fe0c07daa7a667a5679eb86ab3ef9152677213e

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains an embedded OLE object, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is configured to automatically activate upon opening, which is a common technique for delivering malicious payloads. The presence of a high-entropy carved artifact further supports the suspicion of embedded malicious content. No scripts were extracted from this sample.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000082.bin` `576654af48c5bb9fd02acd00304e421c4b044d677960517bbe25700811800107`	rtf-objdata-decoded	RTF \objdata at offset 0x82	471185 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 8.00, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.