Malicious RTF — malware analysis report

Static analysis result for SHA-256 10dfaefba57a3c6c…

MALICIOUS

RTF

81.0 KB First seen: 2024-07-29
MD5: 2c8da4875d07625a4acae6f4bd88be68 SHA-1: d8d24b8625f070e723938d4fe525f3fccd529056 SHA-256: 10dfaefba57a3c6ce034f37c147820c6c034d0d542fab1be6c970ebf4585d516
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.001 Malicious Link: Malicious Link

The file is an RTF document that contains an embedded OLE object, specifically targeting the Equation Editor vulnerability. The `RTF_OBJUPDATE` heuristic indicates that the OLE object is designed to be activated automatically upon opening the document. This strongly suggests an exploit delivery mechanism aiming to execute arbitrary code.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000dfb.bin
40e862ca3d2d41a00d0f30cfecad986de6e323c591ab13060722defc587e247c		 rtf-objdata-decoded RTF \objdata at offset 0xDFB 1803 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.