RTF malware analysis — malicious · eff8eec2de2f4fbe

MALICIOUS

RTF

3.1 KB First seen: 2023-09-14

MD5: 76b1295f1ccade7b25d1f0b68b241719 SHA-1: 999c34a033a53a5cf1fba7e1403dd095579efec2 SHA-256: eff8eec2de2f4fbe30c4583889530b6f2ce5c8f22ba0a607a7915f3e82c2547f

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this object is automatically activated upon opening, likely leading to the execution of malicious code. The specific nature of the payload is not detailed, but the technique points towards exploiting document parsing vulnerabilities for initial execution.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000008d.bin` `1223de4763ffe93f16f5ee7b6c8e92a1adad1c89538858eeeecfb9388dbe3c1c`	rtf-objdata-decoded	RTF \objdata at offset 0x8D	1459 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.