Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 2707f91debc129ae…

MALICIOUS

RTF / .DOC

4.5 KB
MD5: 3893d76a1ab81f9622bf485b13251a1f SHA-1: 8feae47343eaa442c9cce224caeb3f02fa49ef96 SHA-256: 2707f91debc129ae651dadc56eacde0d59c42f191fe1e48f00529d6a80335049
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1559.001 Component Object Model Hijacking

The RTF file contains embedded OLE objects, specifically triggering critical heuristics related to the Equation Editor vulnerability. The presence of \objupdate further indicates that the embedded object is designed to be activated, likely leading to the exploitation of a known vulnerability for arbitrary code execution. No document body text or scripts were extracted, but the heuristics strongly suggest an exploit targeting the Equation Editor.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000000bf.bin
83f36047188e23b2e160edd6cce2ba57b31b4b65ce6ab4e23276a345999a0244
rtf-objdata-decoded RTF \objdata at offset 0xBF 1969 bytes