RTF malware analysis — malicious · ff5c562c5582f749

MALICIOUS

RTF

280.0 KB First seen: 2024-12-03

MD5: 6807ceee28c11bb438468136e40696b2 SHA-1: a649747acd27f2fceb3d61bfde64b12fdf8b7f9c SHA-256: ff5c562c5582f7497860fa901b35160dd39585b1af978ab7fad14d88aa62016d

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The RTF file contains an OLE object, indicated by the RTF_OBJDATA heuristic. The RTF_OBJUPDATE heuristic suggests that this OLE object is configured to activate automatically upon opening, which is a common technique for delivering malicious payloads. The embedded OLE object data, objdata_00_off00000753.bin, is the primary indicator of malicious activity.

Heuristics 2

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000753.bin` `d2e6162f162eebcfbf1083e87dcb7357fcd3f88da4440d4ef0999c9f37d067b1`	rtf-objdata-decoded	RTF \objdata at offset 0x753	4680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.