RTF malware analysis — malicious · e53a57b9be38e41e

MALICIOUS

RTF

805.9 KB First seen: 2024-08-09

MD5: 80e2eb803bed9392466aa384bb8fcf79 SHA-1: a1989067f27f57dc1902d8985462ef86e0eda704 SHA-256: e53a57b9be38e41edf2f8cb4161ad6e155bfcb24990b5e1adbf12c8ba675710b

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

The RTF file contains OLE object data and an \objupdate directive, indicating it is designed to activate embedded objects. The document body explicitly instructs the user to 'click Enable editing from the yellow bar above,' a common lure to bypass macro security settings and execute malicious content. No scripts were extracted, but the presence of OLE objects and the enable editing lure strongly suggest a downloader or exploit delivery mechanism.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00076b84.bin` `8cbde3fe618d2dc776e659287d4d74a76822a3c7f261833e1ae2540d70172a58`	rtf-objdata-decoded	RTF \objdata at offset 0x76B84	1869 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.