RTF malware analysis — malicious · e6d9ca3b117cad95

MALICIOUS

RTF

23.7 KB First seen: 2023-06-19

MD5: f184e823c303d399c0dda9de40c7f45b SHA-1: 69d3911ff6ed2a5e329b5cd88440dc6e33d9b382 SHA-256: e6d9ca3b117cad95d2877702eb25790266da5c0d0424146f61d80d35efdc9e25

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains OLE object data and an \objupdate directive, indicating an attempt to exploit OLE object activation. This suggests the file is designed to deliver a malicious payload when opened, likely through a spearphishing attachment. No specific family could be identified.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000014e9.bin` `be443b0b6ee904313684958ceef29ddfbf3b03de28e05b132c24d6f544ceb4c2`	rtf-objdata-decoded	RTF \objdata at offset 0x14E9	3675 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.