Malicious RTF — malware analysis report

Static analysis result for SHA-256 22e0cb84f8762f89…

MALICIOUS

RTF

98.8 KB First seen: 2024-08-22
MD5: 757aec08a763530ae66de959b507c59b SHA-1: 3a345e0a804937bfa059b290687d4a078b73437d SHA-256: 22e0cb84f8762f899a4d5dab8694e55a49e982b13baae1312e06173bee5a9d2c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 User Execution: Malicious File

The file is an RTF document containing OLE object data, specifically targeting the Equation Editor vulnerability. The \objupdate directive indicates that the embedded OLE object is automatically activated upon opening the document. This technique is commonly used to exploit the Equation Editor vulnerability (CVE-2017-11882) to achieve arbitrary code execution, typically for downloading and executing a secondary payload.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001cfd.bin
45af4247bb1eb57d71c41b1a2f051c17de96b79e84e10a364bd11ffe68c15c78		 rtf-objdata-decoded RTF \objdata at offset 0x1CFD 2040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.