Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 f672cd5e436fa6ad…

MALICIOUS

RTF / .DOC

12.0 KB
MD5: 9bb858ee1eb1a13e9b36f0fec68372ed SHA-1: 69604e79d9ea8b4016f91624bdb51c42820e0e3a SHA-256: f672cd5e436fa6ad28b57438e7bf57c47ceaabe347f3a14e1f80b8489fe1bf2f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The RTF file contains OLE object data and triggers an object update, indicating an attempt to exploit vulnerabilities or embed malicious content. The high-severity RTF_OBJUPDATE heuristic suggests that the embedded OLE object is designed to be activated, likely leading to the execution of a secondary payload. Without further script analysis or network indicators, the exact nature of the payload remains unclear, but the techniques used are consistent with malicious document delivery.

Heuristics 2

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001c60.bin
acda0f779f2f07c30cb1e789532e3a00c3b14fcc34f3545ffec9938992142045
rtf-objdata-decoded RTF \objdata at offset 0x1C60 1885 bytes