RTF malware analysis — malicious · 109893e4fa8718e9

MALICIOUS

RTF

16.3 KB First seen: 2022-10-12

MD5: 805db128041974239ab088a54f9b4437 SHA-1: ae25332cdeb707977924a8f7b6da5beff7061c1b SHA-256: 109893e4fa8718e9f98f5b016c5dd6e64a76cc046a5a4326376c6eafb3fa3b29

160 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object with a critical Equation Editor CLSID, indicating exploitation of CVE-2017-11882. The \objupdate directive suggests that the OLE object is automatically activated upon opening the document, leading to the execution of the embedded exploit. The exploit likely serves as a dropper for a secondary payload, although no specific download URL or payload details were extracted from this sample.

Heuristics 4

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000006b1.bin` `aeec13fe29648091a40fee2770168c8954b7f732594f0938e4f7cf6feb14e9c8`	rtf-objdata-decoded	RTF \objdata at offset 0x6B1	4189 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.