RTF malware analysis — malicious · 0f4b8fec5938d776

MALICIOUS

RTF

115.0 KB Created: 2021-07-16 07:42:00

MD5: 085b1d874543ac04c8a4f047dabdb46f SHA-1: e3c115f28f3d4dbb57279670f98bf42cf9a39f46 SHA-256: 0f4b8fec5938d776b708ac5a5c8d25e93966768f53e4b64b33ecf92e78e8a81d

102 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object that triggers the CVE-2017-11882 vulnerability in Microsoft Equation Editor. This vulnerability allows for arbitrary code execution, indicating a malicious intent to compromise the user's system. No specific malware family could be identified from the available evidence.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003296.bin` `5db3640d47e31dbab118b56a321e16c7371493df17215b948a205f5ee8faab0e`	rtf-objdata-decoded	RTF \objdata at offset 0x3296	4653 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.