equation editor exploit RTF malware analysis — malicious · 3b60500cfb0f7a50

MALICIOUS

RTF

9.2 KB First seen: 2020-02-04

MD5: 90c7eaf76b0624d3e6d388c1d6fbaab9 SHA-1: 80e09ba6c0008f5fa3a69c88f3aca94ed636d3bb SHA-256: 3b60500cfb0f7a50777da71bfb59c75e39874053abd3e729ec68ddc01e211c2e

140 Risk Score

Malware Insights

equation editor exploit · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and specifically triggers the Equation Editor CLSID, indicating an exploit targeting this component. The \objupdate directive forces OLE activation, confirming the exploitation attempt. This pattern is commonly used to deliver malicious payloads via spearphishing attachments.

Heuristics 4

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000032.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x32	4654 bytes
SHA-256: `68da95fffd45fc9b45e95dd6bedfbb257303a4d3c91a513350aa0c1003251586`

Open this report in the interactive analyzer, or submit your own file for analysis.