RTF / .DOC malware analysis — malicious · 253b1531eb0bc7a1

MALICIOUS

RTF / .DOC

502.7 KB

MD5: f73831d6637e540a3fd91d5bc993b16f SHA-1: 76a91b23401f702eda160c7b7f45afbe51d6be9a SHA-256: 253b1531eb0bc7a1c8d4f967a34a3eff40cd822f918f40a5d95e764fe33c8327

202 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.003 Windows Command Shell

The RTF document contains embedded OLE objects, specifically triggering heuristics related to Equation Editor vulnerabilities. The presence of `RTF_EQUATION_EDITOR` and `RTF_OBJAUTLINK` strongly suggests exploitation of a known vulnerability in the Equation Editor component to achieve arbitrary code execution. The `RTF_OLE10NATIVE_STREAM` heuristic indicates a decoded OLE object with high entropy, likely containing a malicious payload. No document body or scripts were extracted, but the RTF structure itself points to a classic exploit delivery mechanism.

Heuristics 6

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000010a9.bin` `4c0d90d8ba5192d632538c9f24f3499e23953fe4eaf59f4b7e508f949fc7fa1d`	rtf-objdata-decoded	RTF \objdata at offset 0x10A9	145972 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.97, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.