RTF / .DOC malware analysis — malicious · 1319505fc2472a04

MALICIOUS

RTF / .DOC

1.98 MB

MD5: 25d799f4d1296a6a9c27fe50126fa1c7 SHA-1: 920a4b1d1fa3a93cb8fbb93dbff1c0311864b66e SHA-256: 1319505fc2472a04296b950737f465502e08e41d107679c7870da0ee3c3c8dc7

222 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains embedded OLE objects, specifically identified as a likely Equation Editor exploit (CVE-2017-11882). This exploit is designed to execute arbitrary code, indicated by the high entropy and size of the decoded OLE object data. The presence of ".objupdate" further suggests an attempt to trigger the OLE object's activation and payload execution.

Heuristics 7

Equation Editor Ole10Native payload — CVE-2017-11882 likely critical CVE likely CVE_2017_11882_EQUATION_OLE10NATIVE

RTF decodes to an activated Microsoft Equation 3.0 OLE storage whose payload is a high-entropy Ole10Native stream rather than normal Equation Native/MTEF data. This is a weaponized Equation Editor RCE delivery shape consistent with CVE-2017-11882/CVE-2018-0802.
Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~2066KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000010f7.bin` `bb5575303eb93cd1b3997908afe2dae08dceda2c796d6c518f5fa973860478b7`	rtf-objdata-decoded	RTF \objdata at offset 0x10F7	318042 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.