RTF malware analysis — malicious · 19e6b35f95984000

MALICIOUS

RTF

84.6 KB

MD5: 6493f3a702027f56b7db04fc5f148619 SHA-1: 2dda3f4304a42e7bbf2a908e324a52d95419e597 SHA-256: 19e6b35f95984000f3bf92d5786437fca8a9d316bff613ad0b81f817f645fad4

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that triggers a buffer overflow vulnerability in Microsoft Equation Editor (CVE-2017-11882). This vulnerability allows for arbitrary code execution upon opening the document. No document body or scripts were extracted, but the critical heuristic firing strongly indicates exploitation.

Heuristics 3

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000023b7.bin` `03b944eef7432191b2d6daa8534b7b5cb23b5faf184b2ecf4301d4883ac1932d`	rtf-objdata-decoded	RTF \objdata at offset 0x23B7	3631 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.