RTF malware analysis — malicious · feb46aa9ceb04365

MALICIOUS

RTF

25.3 KB

MD5: 4670ffaaaecc8661633ce55daeac74cf SHA-1: d87a716b060e8bed33b8c95c2175aa761fe9d6d8 SHA-256: feb46aa9ceb04365001a9ec1b70fabbf235f7d045987e309a6e1e0ac3856629c

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF file that contains OLE object data and uses \objupdate to force OLE activation. The Ole10Native stream within the OLE object is also present and has high entropy, suggesting it contains obfuscated or packed data. These indicators point towards a malicious RTF document designed to exploit embedded objects, likely for payload delivery.

Heuristics 3

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000019de.bin` `68ec56a7de012780b0d72fab59cfece19339bd5c5d1cf75d2d43230f40c891e4`	rtf-objdata-decoded	RTF \objdata at offset 0x19DE	4162 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.