Malicious RTF — malware analysis report

Static analysis result for SHA-256 2898f4d354f22310…

MALICIOUS

RTF

4.4 KB
MD5: 55578f004736fe8b923f75fe5e6bbd69 SHA-1: bbc8eeb7c7a75492a088185effdb02c7901aac5e SHA-256: 2898f4d354f2231043af1cf50a3b4c6af7b209d7112b92a0f949e3084e872fe8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and specifically triggers heuristics related to the Equation Editor vulnerability. This indicates the file is designed to exploit a known vulnerability in the Equation Editor component to achieve arbitrary code execution upon opening. The presence of ".objupdate" further suggests an attempt to force OLE object activation.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000008e.bin
9b0decafe66fb20d3ad7003924feb71bd7fa7a48eedc8394e00790ebb5ab206d		 rtf-objdata-decoded RTF \objdata at offset 0x8E 2006 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.