RTF malware analysis — malicious · 09aa912facf062b3

MALICIOUS

RTF

9.9 KB First seen: 2020-09-15

MD5: 1b0c1c41037f2fe89464b69516065f87 SHA-1: b98e96b3dc8f820333cfd81db85d21c473222587 SHA-256: 09aa912facf062b38ba19a12767e59a3136f0725b347eee2e9b0ce982ae32a8e

122 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains an embedded OLE object that is related to CVE-2017-11882, a known vulnerability in Microsoft Equation Editor. The presence of \objupdate further indicates that the OLE object is intended to be activated, likely leading to the execution of a second-stage payload. The high entropy of the decoded OLE object suggests obfuscated or packed code.

Heuristics 4

Equation Editor OLE1 native payload — CVE-2017-11882 related critical CVE related CVE_2017_11882_RELATED

RTF decodes to an OLE1 Equation.3 embedded object whose native data is large and payload-like, and \objupdate requests automatic activation. This is the delivery shape used by Equation Editor RCE documents such as CVE-2017-11882/CVE-2018-0802, but the malformed MTEF record needed for exact attribution was not recovered.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000337.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x337	4600 bytes
SHA-256: `e1be8450408ee42009df1d7f096a901368fea8d637aaf1ec434172290370d238`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.90, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.