Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 256aac4e7028994e…

MALICIOUS

RTF / .DOC

151.9 KB First seen: 2023-07-06
MD5: 7e6ae847033227fd88c5b0a743850dc4 SHA-1: c1bdb264cceee51bbd7f7575b1323675358a8bf0 SHA-256: 256aac4e7028994ef1b2a0d4ee23e88c64fca975f7aebabd05d206b7996d9783
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious File: User Execution

The sample is an RTF document containing an embedded OLE object, specifically identified as an Equation Editor exploit. The `RTF_OBJUPDATE` heuristic indicates that the object is designed to be activated automatically, suggesting an attempt to execute malicious code upon opening. This is a common technique for exploiting vulnerabilities like the one in Equation Editor to achieve arbitrary code execution.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001e00.bin
bb2058b1f285348c582f90f65da039e1eb6c21149a07e34b033f97a73563c29d
rtf-objdata-decoded RTF \objdata at offset 0x1E00 43192 bytes