Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 315361d4b71c5cbd…

MALICIOUS

RTF / .DOC

14.5 KB
MD5: 01f475b83be658bf91012c4ffcbfccc2 SHA-1: 5638f528926cd1e2f5b52683325e49c7624d34ff SHA-256: 315361d4b71c5cbdd11076ce30cbac544eaa96f3ae42cc0b4d6f9d2e6decc6a5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The sample is an RTF document that contains embedded OLE objects, specifically triggering the Equation Editor vulnerability (RTF_EQUATION_EDITOR). The ".objupdate" directive (RTF_OBJUPDATE) forces the activation of these embedded objects, leading to exploitation. This technique is commonly used to deliver secondary payloads, such as malware downloaders or droppers. No specific family could be identified, but the exploitation vector is clear.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000005d1.bin
6119ea4ad2c2b4d2306cad23d56397b5b8bf47e74b63d384bf7ea982dbf777e8
rtf-objdata-decoded RTF \objdata at offset 0x5D1 1838 bytes