RTF malware analysis — malicious · e8956afd1fc43b92

MALICIOUS

RTF

108.7 KB First seen: 2020-07-24

MD5: 5751e59429a5e2f2688533d931f57b51 SHA-1: e504d46d789dbcff8d13a80cb03f535830566769 SHA-256: e8956afd1fc43b92d12df5533a3aa8313043b4c00d8cd9523dbe0402eba428cd

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE objects and utilizes the \objupdate directive, which are strong indicators of exploitation for client execution. The heuristic firings suggest that this mechanism is used to activate and execute embedded shellcode, likely a secondary payload. The extracted artifact 'objdata_00_off0000146a.bin' is the most critical IOC.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000146a.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x146A	32944 bytes
SHA-256: `fe97b69f871610f66ede1e5b1321aa903e302763a8b4262aac9426e7c8eb5c83`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL

Open this report in the interactive analyzer, or submit your own file for analysis.