RTF malware analysis — malicious · fbc1d4213384d14e

MALICIOUS

RTF

24.9 KB First seen: 2021-10-26

MD5: c53168d1494977e6433cc671f6f9aceb SHA-1: fce4da52da626fcbb2fd2f9c896c260cfa64f011 SHA-256: fbc1d4213384d14e23d204c883c9d6fbf98427210c970852692978d24304da39

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.001 PowerShell

The RTF document contains OLE object data and uses \objupdate to force OLE activation, indicating an attempt to exploit embedded objects. The presence of Ole10Native stream further supports this. While no specific script was extracted, the heuristics strongly suggest a malicious OLE object is embedded, likely designed to execute a payload upon opening.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000018de.bin` `1698c32e8c53b22f474d193324e1e9b801eb99328e749cf443bfba93aeb32e93`	rtf-objdata-decoded	RTF \objdata at offset 0x18DE	4179 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.