Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 2228817b66d357f6…

MALICIOUS

RTF / .DOC

8.7 KB
MD5: 9b7c9be2c5241491c51439797539c85d SHA-1: 1c49e9b5e203b0fb70d61befeacdcee6f4706b66 SHA-256: 2228817b66d357f689cd5aff3ec92326329f3cf613d2cdc295f00d3fa75fa061
220 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The file is an RTF document containing embedded OLE object data, specifically triggering heuristics related to Equation Editor vulnerabilities. ClamAV detection confirms this as Rtf.Exploit.CVE_2017_11882-6584355-1. This indicates the file is designed to exploit the CVE-2017-11882 vulnerability in Microsoft Equation Editor to achieve arbitrary code execution.

Heuristics 5

  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • ClamAV: Rtf.Exploit.CVE_2017_11882-6584355-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Exploit.CVE_2017_11882-6584355-1
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000000b0.bin
14ca58e0f44a156ec093a23f02e4513671d8bbc9dd42201ce7933c70b49fcd4a
rtf-objdata-decoded RTF \objdata at offset 0xB0 4163 bytes