RTF malware analysis — malicious · 072abcd3de210f17

MALICIOUS

RTF

3.9 KB

MD5: 93ea97de046136907db585260184d07f SHA-1: 775502d21b534b3c8cfe1e2f726df54b372be521 SHA-256: 072abcd3de210f17fbe2b4edbfd8b9f7e34bf6f10e79a53a851fd0b4e9adfb08

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and specifically triggers heuristics related to the Equation Editor vulnerability. This indicates the file is designed to exploit a known vulnerability in Microsoft Equation Editor to achieve arbitrary code execution upon opening. The presence of ".objupdate" further suggests an attempt to force OLE object activation, likely to trigger the exploit.

Heuristics 3

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000090.bin` `c6727cdc21da7b76833c9e406bcac65cea542299474e131587ef4325919e1118`	rtf-objdata-decoded	RTF \objdata at offset 0x90	1742 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.