RTF malware analysis — malicious · e98c93c319b7f452

MALICIOUS

RTF

36.5 KB First seen: 2018-11-13

MD5: fbe713a42ba7403b4277a58be672826d SHA-1: 0b9905f156f2c1099bd65ad699108028942df97c SHA-256: e98c93c319b7f452cbded1e0d288548176bd2272bc14026fec72cde40255f6ce

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object that is forced to activate via \objupdate, indicating an attempt to exploit a vulnerability for client execution. While no specific script was extracted, the presence of an embedded OLE object suggests a common delivery mechanism for malicious payloads, often initiated via spearphishing attachments. The embedded URL, though benign, is noted as part of the document's structure.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00008291.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x8291	1581 bytes
SHA-256: `f422c99418a2dd19de45ed9b5dbc88ede3e3d6332c034556e9c2bc295b028410`

Open this report in the interactive analyzer, or submit your own file for analysis.