RTF malware analysis — malicious · 3d652c19b44aa110

MALICIOUS

RTF

60.1 KB First seen: 2018-11-20

MD5: 184cd6b00d51e640f3144352aa0dd6ff SHA-1: 99bad9fdbba1c1232938f739f47f1e0250319671 SHA-256: 3d652c19b44aa1102ce692217b8535f9ee988eda26203c57ef7b412adf443d91

180 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains embedded OLE object data and triggers the CVE-2017-11882 vulnerability. This exploit is known to allow for arbitrary code execution, indicating a malicious intent to compromise the user's system. No specific malware family could be identified.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Exploit.CVE_2017_11882-6934206-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000003c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C	3621 bytes
SHA-256: `cf6e618af0816941fc07213e43bfe42559a05d8d75170b6937badaa648beaec5`

Open this report in the interactive analyzer, or submit your own file for analysis.