Malicious RTF — malware analysis report

Static analysis result for SHA-256 fe8985673f897854…

MALICIOUS

RTF

25.9 KB
MD5: a71865f6a5424719dc6be97b17568ca9 SHA-1: 74159cf10d43fc070a8478c62eeee0d08de08cc9 SHA-256: fe8985673f8978546bb57468fac3862e0a99ae32f05e145b78c71a08e50b6a25
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File T1059.001 PowerShell

The RTF document contains multiple high-severity heuristic firings indicating the exploitation of OLE object vulnerabilities, specifically RTF_OBJAUTLINK and RTF_OBJUPDATE, which force OLE activation. The presence of RTF_OLE10NATIVE_STREAM further suggests embedded malicious content within the OLE object. While no specific script was extracted, the combination of these heuristics strongly implies an attack pattern designed to automatically execute embedded code, likely for downloading and running a secondary payload.

Heuristics 4

  • Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM
    RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001c0e.bin
ae2ece7d7dea7a903c2ba64ae3597f90be9547e407db2921c6ef8e8b9e5f7e43
rtf-objdata-decoded RTF \objdata at offset 0x1C0E 4197 bytes