Malicious RTF — malware analysis report

Static analysis result for SHA-256 06617b9d6ba3a89f…

MALICIOUS

RTF

289.8 KB Authoring application: Riched20 6.3.9600 First seen: 2021-06-17
MD5: 550b99a9aa969d033601deb7e1cf371f SHA-1: 19fbef2d6ff6a790b32a74d6b7d2abb1ebac129e SHA-256: 06617b9d6ba3a89f30e4a6298bd8619bff95e24ecd15d9e67c7223cda9f90500
240 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains an embedded OLE object specifically identified as Microsoft Equation Editor, triggering critical heuristics for exploitation. ClamAV detection confirms this as Rtf.Exploit.CVE_2018_0802-6624871-1, indicating a known exploit targeting the Equation Editor. This strongly suggests the file is designed to deliver a malicious payload via exploitation of a client-side vulnerability.

Heuristics 6

  • ClamAV: Rtf.Exploit.CVE_2018_0802-6624871-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6624871-1
  • Equation Editor object class critical RTF_OBJCLASS_EQUATION
    Object class 'equation.3' references Equation Editor
  • Equation Editor ProgID + OLE object high RTF_EQUATION_EDITOR
    RTF references Equation.3 ProgID alongside \objdata — likely Equation Editor (CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798) but without the binary CLSID payload, so flagged at HIGH instead of CRITICAL.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000100.bin rtf-objdata-decoded RTF \objdata at offset 0x100 16783 bytes
SHA-256: 1538870aef5c527b4db9c22c747297bfcb9af0a60de66338622f14f4aea43b3c

Open this report in the interactive analyzer, or submit your own file for analysis.