Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 ea300c022a11630d…

MALICIOUS

RTF / .DOC

24.4 KB First seen: 2023-05-18
MD5: ea9b84b2ac588b02dc5cdccd53a3ad2f SHA-1: 29cb5fe26725c0de7e9f2a2d70a25b46d4836e04 SHA-256: ea300c022a11630d0c5c0872fc95059a40f11590c924aaa4fec142fcc70a272c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains OLE object data and an \objupdate directive, indicating an attempt to exploit RTF parsing vulnerabilities for automatic object activation. This is a common technique for delivering malicious payloads, likely involving a secondary download stage. No specific family could be identified from the available heuristics.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000642.bin
9e40f56684653ca9367a0d20fbae0ab82d93c5690b9612ade0dad49aee9985bb
rtf-objdata-decoded RTF \objdata at offset 0x642 4696 bytes