Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 385ecab95b120c5b…

MALICIOUS

RTF / .DOC

1.26 MB
MD5: 580da9e763f24ea7738f24a17d503281 SHA-1: a504d0fced675da3264731d588fce1fa125f5338 SHA-256: 385ecab95b120c5b06abffa3c50cbc5d2a5da7adf454a46de286654590d1b57f
180 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document containing an embedded OLE object that leverages the Equation Editor vulnerability (CVE-2017-11882). The ".objupdate" directive forces the activation of this embedded object, leading to arbitrary code execution. The document body contains obfuscated JavaScript-like code, likely intended to download and execute a secondary payload, though its exact function is obscured.

Heuristics 5

  • Equation Editor activation — CVE-2017-11882 related high CVE related CVE_2017_11882_ACTIVATION_RELATED
    RTF decodes to an Equation.3 ProgID and requests OLE activation with \objemb plus \objupdate. This reaches the legacy Equation Editor attack surface used by CVE-2017-11882/CVE-2018-0802 documents, but the malformed MTEF/native payload needed for stronger attribution was not recovered.
  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001038.bin
3ab5a5ead8ed71a4d098714e531f0e0eb7addbc78259f4a8dbd0363377714bd1		 rtf-objdata-decoded RTF \objdata at offset 0x1038 33124 bytes
objdata_01_off0001bd7f.bin
3bb3eee7278e822ff5687cd7c2b3862b4e8bb63212ee9ebbae6c04d4cb6de63c		 rtf-objdata-decoded RTF \objdata at offset 0x1BD7F 303681 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.