Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 031919fccd90c7ab…

MALICIOUS

RTF / .DOC

18.7 KB First seen: 2022-08-22
MD5: 6d15e3e99c58b5b27cb2275b10fddc09 SHA-1: d4fb69f744c7f74a5e863ecb10862c363305683d SHA-256: 031919fccd90c7ab5f0314ddb00ff494d3cac445ae8f349cef2fd69f8d36c01f
180 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1566.001 Phishing: Spearphishing Attachment T1059.005 Command and Scripting Interpreter: Visual Basic

The sample is an RTF document that leverages the CVE-2017-11882 vulnerability in the Equation Editor. The document body contains a lure instructing the user to 'enable editing' to view the content. The presence of OLE object data and automatic linking further indicates exploitation of embedded objects. This exploit is commonly used to download and execute a second-stage payload.

Heuristics 5

  • CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
    Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001cff.bin
8f6ec8e39b05f329f8544b1de1723807ff168889a2f7bacf09cfe446574901e7
rtf-objdata-decoded RTF \objdata at offset 0x1CFF 3720 bytes