RTF malware analysis — malicious · 0965632978678378

MALICIOUS

RTF

62.7 KB First seen: 2022-10-12

MD5: f28a37deaebd9a66da7829b424f06a25 SHA-1: 9bf63190c51f0c3ffc191107ca4eff868e79f991 SHA-256: 096563297867837884f69363c98b5208a8b4fb92ce81535d9e4c7c6e27cb8fa0

140 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object that triggers a known vulnerability, CVE-2017-11882, in the Microsoft Equation Editor. This exploit allows for arbitrary code execution, which is typically used to download and execute a second-stage payload. No document body text or scripts were extracted, but the critical heuristic firing strongly indicates exploitation.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000d83.bin` `64e7194e08be75fa7a8231151df213e9d5f17835afe6900637528c40a203499f`	rtf-objdata-decoded	RTF \objdata at offset 0xD83	4168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.