RTF malware analysis — malicious · 3383ae603352ca4a

MALICIOUS

RTF

14.9 KB First seen: 2020-09-07

MD5: 0db241b689d7de55548151d148c9e43f SHA-1: 9b99e31f8ea888d77c67e7c5cffadcdef2f60b77 SHA-256: 3383ae603352ca4aa5e8bb374b3e6e735d22e891821fc8f3805d4a9a995e9ea2

220 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an RTF document that contains an OLE object with an obfuscated Equation Editor ProgID, strongly indicating exploitation of CVE-2017-11882. The presence of ` tfobjupdate` and ` tfobjdata` directives further suggests that the embedded object is designed to be activated automatically. This exploit typically leads to the execution of shellcode, which is likely responsible for downloading and executing a subsequent stage.

Heuristics 6

Obfuscated Equation Editor ProgID + activation critical CVE related RTF_EQUATION_EDITOR

RTF decodes to an Equation.3 ProgID from top-level \objdata hex after nested RTF junk groups are ignored, and the document also contains \objemb plus \objupdate activation. This is an obfuscated Equation Editor exploit surface associated with CVE-2017-11882 / CVE-2018-0802 families, but no exact malformed MTEF CVE primitive was recovered from this object.
Equation Editor activation — CVE-2017-11882 related high CVE related CVE_2017_11882_ACTIVATION_RELATED

RTF decodes to an Equation.3 ProgID and requests OLE activation with \objemb plus \objupdate. This reaches the legacy Equation Editor attack surface used by CVE-2017-11882/CVE-2018-0802 documents, but the malformed MTEF/native payload needed for stronger attribution was not recovered.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000014de.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x14DE	1630 bytes
SHA-256: `cc6d8accdc433620b2c400c8dc3561272a81921ac71b1cd9253dbafd48470956`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL

Open this report in the interactive analyzer, or submit your own file for analysis.