Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 2452aaebfca37c5b…

MALICIOUS

RTF / .DOC

217.5 KB First seen: 2022-04-14
MD5: 7f3371bad86bb6896f5e6c9a7be55e74 SHA-1: 57e9e312582896a3235a028501eaf1ceae835f58 SHA-256: 2452aaebfca37c5b5b6f2e4cef6a48a55628a4306345f2c17f3bebbe92ef65fb
123 Risk Score

Malware Insights

MITRE ATT&CK
T1559.002 Component Object Model and Distributed Component Object Model T1204.002 Malicious File

The RTF document contains multiple OLE objects, with heuristics indicating the use of ".objupdate" and Composite Monikers. This suggests the document is designed to exploit OLE activation mechanisms to trigger embedded malicious code. The specific nature of the embedded payload could not be determined from the available data.

Heuristics 4

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000007d2.bin
500215b3bd7c05aba144bd589cc74d55c762a37c9eea2208205b0484cdc4f3c6
rtf-objdata-decoded RTF \objdata at offset 0x7D2 15677 bytes
objdata_01_off000087d1.bin
36dcadcd9dba6c796320cf103eee4d99a0cf65218f74bac40d0f472a6487a1f8
rtf-objdata-decoded RTF \objdata at offset 0x87D1 2632 bytes
objdata_02_off00009d74.bin
44deae4627fee3c44f54d5bd10477ec2e17f4c08135f08e2417832e36d10d037
rtf-objdata-decoded RTF \objdata at offset 0x9D74 12297 bytes