RTF malware analysis — malicious · ee0cac0d318f5f50

MALICIOUS

RTF

4.0 KB First seen: 2023-08-31

MD5: 801f1580112977b562bf873d5f68c23b SHA-1: a39d81cd1047a15d84d5ae1eb2bece0599111cae SHA-256: ee0cac0d318f5f50ed54e662794819ed731abee9203a3f8e1445add029ef37bd

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this embedded object is designed to be automatically activated upon opening the document, likely exploiting a vulnerability to execute arbitrary code. The specific exploit and payload are not detailed in the provided evidence.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000008c.bin` `c219c91289d8cfe3267ddb60ad419838369fd53059b7bb1301c0ffcff5979c05`	rtf-objdata-decoded	RTF \objdata at offset 0x8C	1933 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.