Malicious RTF — malware analysis report

Static analysis result for SHA-256 200343f982f1ecc7…

MALICIOUS

RTF

32.1 KB
MD5: 397d52e1f05c64c10be1780af19f8166 SHA-1: 559b4d00266f839be014426b98423334dfdc3677 SHA-256: 200343f982f1ecc729dbfe0d9c5289eec03ee5d7db78f15d1483eee720b76eb2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is an RTF document containing embedded OLE objects, specifically triggering heuristics related to the Equation Editor vulnerability (CVE-2017-11882). The \objupdate heuristic indicates that the embedded object is designed to be activated automatically, which is a common technique for exploiting this vulnerability. The presence of OLE object data further supports the exploitation vector. While no specific script was extracted, the heuristics strongly suggest the document's purpose is to exploit the Equation Editor to achieve code execution, likely for downloading and running a subsequent stage.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000ad4.bin
04eb4b5244e3dddcdd06874d892892ad4b619db786fb9a0ddcf4603fc96292cc		 rtf-objdata-decoded RTF \objdata at offset 0xAD4 2027 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.