Malicious RTF — malware analysis report

Static analysis result for SHA-256 f0e3a280f5b330d9…

MALICIOUS

RTF

87.8 KB
MD5: ab5c06c8e2d45641e44a427006a88bcf SHA-1: fab7efaf73e457aaaa31c309af0c33a8abc7a9af SHA-256: f0e3a280f5b330d938f0e772399be7a629be6593bd1bc78f7475ddff10931d8b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.001 PowerShell

The RTF file contains OLE object data and an \objupdate directive, indicating it's designed to exploit OLE activation vulnerabilities. This strongly suggests a malicious intent to execute embedded code or trigger a download. Without a document body or script content, the exact payload and delivery mechanism remain unclear, but the RTF structure points towards a classic exploit delivery method.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000015f2.bin
bc73dfc36da658acaea6f278aa3e808d3785c11232e5c45827856c6c641e747c		 rtf-objdata-decoded RTF \objdata at offset 0x15F2 24206 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.