RTF malware analysis — malicious · e9cf4a2fe44de912

MALICIOUS

RTF

23.5 KB First seen: 2023-06-08

MD5: ce692ee68ccc4b7fb7381f0eabfa6891 SHA-1: ea62365271dcf5faf66958cf2505faa8e5b8e772 SHA-256: e9cf4a2fe44de91205a9147d0108c53b58f964e3c57011e0413cfb4fcb39573d

80 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1027 Obfuscated Files or Information

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA and RTF_OBJEMB heuristics. The RTF_OBJUPDATE heuristic suggests that the embedded object is designed to be activated automatically, which is a common technique for delivering malicious payloads. The objdata_00_off00000bc2.bin artifact is the decoded OLE object, likely containing the malicious executable.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000bc2.bin` `7dc170c37e0b96cf859a9ec9f34348d00fb9c15f66052bcf6cb661b6386a5df1`	rtf-objdata-decoded	RTF \objdata at offset 0xBC2	4197 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.