RTF malware analysis — malicious · f75dc57cfde7efbd

MALICIOUS

RTF

3.3 KB First seen: 2023-01-28

MD5: d0cc5d745e2dc7c1e696bcc5c2abea36 SHA-1: d1df1eaa82ea31c18a4c6071c75e9f004eefb317 SHA-256: f75dc57cfde7efbde644182de35e99b08e4d7e90aa6117953df02e773e00cb68

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and an \objupdate directive, indicating an attempt to exploit OLE object activation. This is a common technique for delivering malicious payloads, often via spearphishing attachments. The specific exploit targeted is not detailed, but the mechanism is clear.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000007a.bin` `ad4b1f0c87d863ec12187f488f0a64cb6ed35fd49f795c1b50552c9ba135e634`	rtf-objdata-decoded	RTF \objdata at offset 0x7A	1577 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.