Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 0f03bd956f66f37b…

MALICIOUS

RTF / .DOC

35.3 KB First seen: 2023-05-15
MD5: 815aaf468cbbe22d7174593a6d035cc0 SHA-1: 95b8a186905b65ae7ac60d9a1c7433b8f3673994 SHA-256: 0f03bd956f66f37bf27fb78bcc3d1d05f289755e94a4e4dc2b7d4717c30d611d
160 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

The sample is an RTF document that exploits the Equation Editor vulnerability. It contains an OLE object that is likely intended to execute a malicious payload upon activation, as indicated by the \objupdate heuristic. The document body presents a lure, instructing the user to 'Enable editing' to view the content, which is a common social engineering tactic to bypass macro security settings and facilitate malware execution.

Heuristics 5

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000050aa.bin
d6403474f6f08a24b4381cbc6c5d409daeb1be237ea97a9835a154ae125c600c
rtf-objdata-decoded RTF \objdata at offset 0x50AA 1402 bytes