Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 35bb9865c7e1aa02…

MALICIOUS

RTF / .DOC

239.3 KB
MD5: 1896f082fb946791cb74b3d56887e57b SHA-1: a55fee846a5410dede9fb365a2e5060f12cf09d3 SHA-256: 35bb9865c7e1aa026541b3547618b9f5d49bd176cf912914d52cd64f8f6e7cbe
120 Risk Score

Malware Insights

MITRE ATT&CK
T1204 User Execution T1059 Command and Scripting Interpreter

The sample is an RTF document that leverages the Equation Editor vulnerability (CVE-2017-11882) to execute arbitrary code. The presence of OLE object data and the ".objupdate" directive strongly indicate that the document is designed to trigger an exploit. This exploit likely leads to the download and execution of a secondary payload, a common technique for initial access.

Heuristics 3

  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001118.bin
d99d081844d57f1a2879b2d75376566545afafc9928d0fd4389c2f5f34bd8f36
rtf-objdata-decoded RTF \objdata at offset 0x1118 66996 bytes