RTF malware analysis — malicious · 1af65c0aca4c3b95

MALICIOUS

RTF

8.4 KB

MD5: c26a093f3d0531e68a923bae27cd1b12 SHA-1: 06fa550b5ff9291c48aa342d80f6ad6f24d47629 SHA-256: 1af65c0aca4c3b95340457e22f166006838453a38db95a1bbaba4fbf124ec604

180 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object with data indicative of the Equation Editor vulnerability (CVE-2017-11882). The presence of RTF_OBJDATA, RTF_EQUATION_EDITOR, and RTF_OBJUPDATE heuristics, along with ClamAV detection for Rtf.Exploit.CVE_2017_11882, strongly suggests exploitation for client execution. No specific family could be identified, and no further IOCs were extracted.

Heuristics 4

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
ClamAV: Rtf.Exploit.CVE_2017_11882-6584355-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2017_11882-6584355-1
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000063.bin` `04545f65c6afd895529d9f7990d4d0e9cd8dc95db152fc9ec82fe8573caafff3`	rtf-objdata-decoded	RTF \objdata at offset 0x63	4160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.