RTF malware analysis — malicious · 07ea9cbf9fa299b1

MALICIOUS

RTF

511.6 KB First seen: 2019-09-30

MD5: d0959f570609758708164c1b173761d9 SHA-1: e56daf707fdec49255b3b3e991750017cb5a9342 SHA-256: 07ea9cbf9fa299b18fbead7b39ca77c136bc1585273773403d741481be79d23e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample is an RTF document identified by ClamAV as Doc.Exploit.CVE_2017_11882-6934206-0, indicating exploitation of the Equation Editor vulnerability. The presence of OLE object data and the ".objupdate" heuristic further support this, as these are common mechanisms for exploiting this vulnerability to achieve arbitrary code execution.

Heuristics 3

ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Exploit.CVE_2017_11882-6934206-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000691.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x691	4145 bytes
SHA-256: `bf8fb8bfce72a8b4c353ab123602f888e4b2305adffc9f27af7081869901e20e`

Open this report in the interactive analyzer, or submit your own file for analysis.