RTF malware analysis — malicious · e7af132ce1310c69

MALICIOUS

RTF

2.64 MB

MD5: 7b4d75d4c9a69092b41b9eb2d22578ce SHA-1: 0a5338447515bee974b77b8e8d75bae2b721df3c SHA-256: e7af132ce1310c69a81802daeb13719c4e4264f081727fb708e41dcd8993830d

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains a large OLE object with excessive hex-encoded data, indicated by the RTF_EXCESSIVE_HEX heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be activated, likely to drop and execute a payload. The presence of a large, encoded OLE object within an RTF document is a common technique for delivering malware. No specific family could be identified.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~2770KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000077.bin` `cc601b93c70b11563a3201ceb27138dcf6d361f3f9c1038f94357df077187941`	rtf-objdata-decoded	RTF \objdata at offset 0x77	1385346 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 8.00, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.