RTF / .DOC malware analysis — malicious · 39bf1bb7d4a4f5aa

MALICIOUS

RTF / .DOC

3.6 KB First seen: 2022-03-23

MD5: 709320af2bfcefc1e2c29efef527e1f7 SHA-1: 36ecd8b6530e0df65b44bd6210b6680163650853 SHA-256: 39bf1bb7d4a4f5aa4e6cf353295d3d7514da5dd57c66b4ae8ddadb27b43f0c98

121 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1559 Component Object Model Hijacking T1559.001 Component Object Model Hijacking: Component Object Model

The RTF document contains OLE object data and specifically triggers the Equation Editor vulnerability. The \objupdate directive forces OLE activation, indicating an attempt to exploit the embedded object. This pattern is commonly used to deliver a second-stage payload.

Heuristics 3

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000b1.bin` `51b874a17bd025eeea051940f7811fcba2d4e61a13c074b5043642aac692327f`	rtf-objdata-decoded	RTF \objdata at offset 0xB1	1606 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.