RTF malware analysis — malicious · 2ca38c8449b06e32

MALICIOUS

RTF

97.0 KB Created: 2021-07-16 07:42:00

MD5: 3718afcd13bfa81441b96e2074e38d48 SHA-1: 654810511c08a59d57c359208024624f15688462 SHA-256: 2ca38c8449b06e32895dd2d77ccda27856f3321028f65b2c53e2cefb1d4b2d38

102 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains an embedded OLE object that triggers the CVE-2017-11882 vulnerability in the Equation Editor. This exploit is known to be used for arbitrary code execution, likely to download and run a secondary payload. The presence of the exploit and the malicious verdict strongly indicate this attack pattern.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003014.bin` `0109f29ba73d8a06ba5b0763ff15e485d8a02093d47d8d94baa960f825669f10`	rtf-objdata-decoded	RTF \objdata at offset 0x3014	3631 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.