RTF malware analysis — malicious · fde8dca9b93f9c9d

MALICIOUS

RTF

27.4 KB First seen: 2023-06-07

MD5: a82d5070b20af38ed372d74774a661b8 SHA-1: 5899cb279cec496199115377ecfc5fcf0f1c83c7 SHA-256: fde8dca9b93f9c9df67d9a2698d73f1b5ae098a5cdc6c0f3e92b267d3b78dd18

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains OLE object data and uses an \objupdate directive, indicating an attempt to exploit OLE object activation. This suggests the file is designed to exploit a vulnerability, likely for initial execution of a malicious payload. The specific exploit is not identifiable from the provided heuristics, leading to an unknown family classification.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000193a.bin` `f7830986a27e1fdf38390516880feaa19dc8e118583e027a13b3fdb2938c2290`	rtf-objdata-decoded	RTF \objdata at offset 0x193A	4208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.