Malicious RTF — malware analysis report

Static analysis result for SHA-256 10687220021a776a…

MALICIOUS

RTF

35.2 KB First seen: 2023-06-02
MD5: 8a5c3b0f57f61e18ff31ae4903f479fa SHA-1: 4aedb5352db0360e8d31cdfe5a773f3ac02e8c74 SHA-256: 10687220021a776a401570d83c20d5adf289a8f41c48f48bb76b5c92184a6bc4
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1059 Command and Scripting Interpreter T1059.005 Command and Scripting Interpreter: Visual Basic

The sample is an RTF document that contains an embedded OLE object, specifically targeting the Equation Editor vulnerability. The presence of \objupdate indicates that the embedded object is designed to be activated automatically, likely triggering the exploit. The SE_ENABLE_LURE heuristic suggests the document also contains text prompting the user to enable editing or macros, a common social engineering tactic to bypass security measures and facilitate the execution of the exploit.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00004db2.bin
ea0df304d6f0076a80fc1b107ecf8fb5b7d7c6c3106df5aa0d8af38d8b787741		 rtf-objdata-decoded RTF \objdata at offset 0x4DB2 2021 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.