RTF malware analysis — malicious · 31359b532ab69c13

MALICIOUS

RTF

494.4 KB Created: 2021-07-16 07:42:00

MD5: 21b322b38f750190590090a5155561b7 SHA-1: 10febd6ec92eb1c4f3db05a7941697b73ab0d573 SHA-256: 31359b532ab69c1315d9fb207eade691c519918f0aafeef9e559c1ad58c15478

102 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that triggers the CVE-2017-11882 vulnerability in Microsoft Equation Editor. This vulnerability allows for arbitrary code execution, indicating a malicious intent to compromise the user's system. No specific malware family could be identified.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000330f.bin` `742c51f8db6a7ebde67b0ccce0ddb01763e72c540d6428aa8ad84a29ce5a50e6`	rtf-objdata-decoded	RTF \objdata at offset 0x330F	195821 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.