RTF malware analysis — malicious · 23b268b8d7a26976

MALICIOUS

RTF

11.7 KB First seen: 2019-11-20

MD5: b6812fe0ef8cf0e8758cad842a00213a SHA-1: 6cc225c4341a970b5f5a015d83426c80f946ea64 SHA-256: 23b268b8d7a269760768f30ed66778d50081a953a16ee5a0e61f8327579aef1c

160 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object with a CLSID indicative of the Equation Editor, and uses \objupdate to force activation. This strongly suggests exploitation of a known vulnerability (CVE-2017-11882) to achieve code execution. The embedded OLE object's native stream has high entropy, suggesting it likely contains a secondary payload. No document body or scripts were extracted, limiting further analysis of the payload's intent.

Heuristics 4

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000c38.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xC38	4197 bytes
SHA-256: `6f3275ed56530e21fb750510472b6c4560535333d818be7cb01caecdc28aee70`

Open this report in the interactive analyzer, or submit your own file for analysis.