RTF malware analysis — malicious · eae28676b3f41e57

MALICIOUS

RTF

21.7 KB First seen: 2023-03-28

MD5: 1b91a9d902d2d5c7f9c094955a1537f4 SHA-1: 5be78c40823d48f69824fc1f86e77abf8660e766 SHA-256: eae28676b3f41e57ff75b2c209f76904e1e82bc2007093dde99df753d7e4fc52

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document containing an embedded OLE object, as indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is designed to be automatically activated upon opening, which is a common technique for exploiting vulnerabilities or delivering malicious payloads. The truncated document body and lack of script content prevent a more detailed analysis of the payload's intent, but the overall mechanism points to a malicious attachment designed to trigger further execution.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000d4c.bin` `353a3402b69e9c2ef5452e6bf2fe4f15ebcfeb52b63d34711599932a387fbd36`	rtf-objdata-decoded	RTF \objdata at offset 0xD4C	3642 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.