RTF malware analysis — malicious · 28617a9f74e63eb7

MALICIOUS

RTF

12.5 KB

MD5: 99b3c17718192892d07fd82abf6263f2 SHA-1: 736f426da9caa20c2fac1462fd409ec0e94b9567 SHA-256: 28617a9f74e63eb7934e8cad9ac9218d2fcfe7ac2eab3f590790cedb06f6c95f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains OLE object data and specifically triggers heuristics for Equation Editor exploitation and OLE activation. This indicates the file is designed to exploit a vulnerability in the Equation Editor component, likely to execute arbitrary code. No document body text or scripts were extracted, but the heuristics strongly suggest a malicious exploit delivery mechanism.

Heuristics 3

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001d70.bin` `73804b6cd3a190e0b81d54c71d4edd12fc738a421f52a86ea67540aea90851e9`	rtf-objdata-decoded	RTF \objdata at offset 0x1D70	1583 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.