Malicious RTF — malware analysis report

Static analysis result for SHA-256 117ee949cd079b91…

MALICIOUS

RTF

3.2 KB First seen: 2019-03-18
MD5: 24fa7972a0c8bf6083bf068aa1c32c80 SHA-1: f9238568230c22a892723783da41ec6151d15363 SHA-256: 117ee949cd079b91e3e82d3fccc8ffb7e648ce7d434494fa8ec4d5a33edab03e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and specifically triggers heuristics for the Equation Editor vulnerability. This indicates the file is designed to exploit CVE-2017-11882, allowing for arbitrary code execution. The embedded object data likely contains shellcode intended to download and execute a secondary payload, a common technique for initial compromise.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical CVE likely RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000003b.bin rtf-objdata-decoded RTF \objdata at offset 0x3B 1596 bytes
SHA-256: 6bf4086adb361d95c0ebf1d12849db00ee77005afbb75440d51ce235ceae9cc7

Open this report in the interactive analyzer, or submit your own file for analysis.