RTF malware analysis — malicious · ea5d6ba826efac4c

MALICIOUS

RTF

9.3 KB

MD5: 148ef09fbae778e2434d070bb65478c7 SHA-1: 0f88ec65f42605639eeec9c9192b63fb01a3e917 SHA-256: ea5d6ba826efac4cc81af231393f7d13c93d7a7eee1686641a4715a9239064db

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The RTF document contains OLE object data and triggers OLE activation, indicating an attempt to exploit vulnerabilities or execute embedded code. While no specific document body content or scripts were provided for analysis, the heuristic firings strongly suggest a malicious intent, likely involving the execution of a secondary payload. The confidence is moderate due to the lack of explicit script or body content to confirm the exact execution flow.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000013cd.bin` `c98d3ab4519aa633149117c3138acf2f8f8727eb049b38231a6c01d8f40d662f`	rtf-objdata-decoded	RTF \objdata at offset 0x13CD	1633 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.