RTF malware analysis — malicious · 0a73a7cad42160b5

MALICIOUS

RTF

1.53 MB

MD5: 4f9bf95254ac818ee13e8c4915a23aa0 SHA-1: ef179f649207242a908fbb60c22dd991fe75351b SHA-256: 0a73a7cad42160b50b6ce1a88d9fadbc2761e6009b1672e884abab11d32eb94a

242 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple indicators of exploitation targeting Microsoft Equation Editor, including specific CLSID and OLE object data. The presence of a large, hex-encoded OLE object suggests it is hiding a payload. The embedded URL, though marked benign, is often used in conjunction with such exploits to download further stages. The file's structure strongly suggests it's delivered as a spearphishing attachment to exploit a client vulnerability.

Heuristics 7

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1603KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://bit.ly/3c0vstV

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000006f6.bin` `ebde082119bddf9e26fe4f7abd5ac5fc1db6f2c72f321fbd36a0ac56dee26f6b`	rtf-objdata-decoded	RTF \objdata at offset 0x6F6	801872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.