Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 385a311e2e1ff1b4…

MALICIOUS

RTF / .DOC

8.9 KB First seen: 2022-03-08
MD5: c98bd83f286b7f7ca6dff26592f40d92 SHA-1: 737310802652b3fa28062e72fc047813f5ce0400 SHA-256: 385a311e2e1ff1b4afbe099cf065bf60c6a6b22537cf6976410b3d3b2b156ed9
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is an RTF document that leverages the Equation Editor vulnerability (CVE-2017-11882) to execute arbitrary code. The presence of `RTF_OBJDATA`, `RTF_OBJAUTLINK`, and `RTF_OBJUPDATE` heuristics strongly indicates the exploitation of OLE object data and automatic linking for activation. The primary attack vector is likely a spearphishing attachment, leading to the download and execution of a secondary payload.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000012fa.bin
ffbf19e95d528f3a654220a48afd45499b8bd4d7bf9cdb9e10b36f995e662dd8
rtf-objdata-decoded RTF \objdata at offset 0x12FA 1977 bytes