RTF malware analysis — malicious · f743a86539017023

MALICIOUS

RTF

421.8 KB First seen: 2024-06-10

MD5: 4447ab2143a08d8b67f131c4cbd9c316 SHA-1: d2eb154acb987942e6bcaafe2400b7f3926f0422 SHA-256: f743a86539017023aae3ea9c35d42f092b42dc9ea8bc90154e4b88c6f57fd1f1

80 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing via Service

The RTF file contains OLE object data and an \objupdate directive, indicating it's designed to activate embedded objects. The document body provides a lure about financial audits, instructing the user to 'enable editing', a common tactic to bypass security measures and allow malicious content to execute. This suggests the file is a dropper intended to download and run a secondary payload.

Heuristics 3

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00015c66.bin` `ae573d4773178029321d2e7aa02f6a3e5aae888384ae2de59a1a432e6788d40b`	rtf-objdata-decoded	RTF \objdata at offset 0x15C66	1520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.