RTF malware analysis — malicious · 3a835fa75d29cd92

MALICIOUS

RTF

113.0 KB Created: 2021-07-16 07:42:00

MD5: f0089a760145da705a28a4d7bbb37735 SHA-1: 04465ffbd64e09ad7abc2644951dc7a1aa78765c SHA-256: 3a835fa75d29cd926eb6e9f17478695afeb3f781d43ecd23f2057372fab9b634

102 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that triggers the CVE-2017-11882 vulnerability in Microsoft Equation Editor. This vulnerability allows for arbitrary code execution, indicating a malicious intent to compromise the system. No specific family could be identified, but the exploit is a common method for initial compromise.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000032f0.bin` `ebc7df0d427dd3b20aa3fbf26441ba88e5b32dd6f80b05dfa25b8fc1048cc3a3`	rtf-objdata-decoded	RTF \objdata at offset 0x32F0	3629 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.