Malicious RTF — malware analysis report

Static analysis result for SHA-256 0469abfbc9e8361f…

MALICIOUS

RTF

53.4 KB First seen: 2019-01-11
MD5: 130d3a9c710282fb7add309c4dd1d4c5 SHA-1: 8deec0ee0833cf0b2043414d8210e0083cb5b071 SHA-256: 0469abfbc9e8361f14832a6450e48525dfe374b3a6baa585c01d3da7a82074db
180 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and triggers the \objupdate directive, indicating an attempt to activate embedded objects. Heuristics confirm the presence of the CVE-2017-11882 vulnerability, a known exploit in Microsoft Equation Editor, which is likely used to achieve code execution. The file is classified as malicious due to this exploit.

Heuristics 4

  • CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
    Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
  • ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Exploit.CVE_2017_11882-6934206-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000003b.bin rtf-objdata-decoded RTF \objdata at offset 0x3B 4155 bytes
SHA-256: 6c7432f76bf27050f04cfd08d0fd8c9de158a7cfeab19080ca63216b28d4d1b1

Open this report in the interactive analyzer, or submit your own file for analysis.