RTF malware analysis — malicious · 248bc88383b5b049

MALICIOUS

RTF

163.6 KB Created: 2021-07-16 07:42:00

MD5: 9eb34ebb3afc669dddc727f57e5de77c SHA-1: d1d476a84d91d64b4eb4f4e434c27416031dc18f SHA-256: 248bc88383b5b04964fd83b64b9a80813bfafabcf3bb1986110eb8a26bd175ea

102 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that triggers the CVE-2017-11882 vulnerability in Microsoft Equation Editor. This vulnerability allows for arbitrary code execution, indicating a malicious intent to compromise the user's system. No specific family could be identified, but the exploit is a common method for initial compromise.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000032fc.bin` `2f6a6d1f604eb609e8ce8eb83f107b9357e62cfa902f50e33b3031bbd1aa8858`	rtf-objdata-decoded	RTF \objdata at offset 0x32FC	28445 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.