RTF malware analysis — malicious · f566e5b5f2467069

MALICIOUS

RTF

4.1 KB First seen: 2020-05-25

MD5: 591ca69515e76881d879b335b96609e9 SHA-1: 392b972ca98d5f3a0990412c14be7edfddf125f0 SHA-256: f566e5b5f246706909eacc0a7822e6f2fd5a6db06c64248cddeeabce2c3097ac

80 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data, indicated by the RTF_OBJDATA heuristic. The RTF_OBJDATA rule also fired, suggesting that the embedded OLE object is intended to be activated, likely to execute malicious code. The extracted artifact 'objdata_00_off00000167.bin' is flagged as a potential shellcode candidate, further supporting the exploitation of a client execution vulnerability. The lack of readable document body text or scripts means the specific lure or payload is not discernible, but the technical execution path is clear.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000167.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x167	1878 bytes
SHA-256: `7f9259d4d063226fab4ad7207e7a98a0a3fa3cc1057079049bded57c46d65039`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL

Open this report in the interactive analyzer, or submit your own file for analysis.