RTF malware analysis — malicious · f5dba1abee1efc99

MALICIOUS

RTF

4.77 MB

MD5: b2d1cb4a5ed1ad7b822bda9541b1788c SHA-1: c51dd7f70eb29ced7c0d50d0935d2365614b0a82 SHA-256: f5dba1abee1efc99b1c707b862b209698028ece5ff8f7962fc45417960fa4afc

140 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains multiple high-severity heuristic firings indicating the presence of embedded OLE objects with excessive hex-encoded data. The \objupdate directive suggests an attempt to force OLE activation, likely to execute a hidden payload. The large size and entropy of the decoded OLE object further support the hypothesis that it contains a malicious payload. The file's SHA256 hash is included as an IOC.

Heuristics 4

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~5000KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000b0.bin` `8728b1ea44ecaaaaee2c9336fc9eeea4c3cd319c0f8be06293a3b85ba85eb19d`	rtf-objdata-decoded	RTF \objdata at offset 0xB0	999498 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.