Malicious RTF — malware analysis report

Static analysis result for SHA-256 4084e0b4eaa3a33a…

MALICIOUS

RTF

45.6 KB First seen: 2023-07-19
MD5: a4743d2d063536c3ecd49063e9b266e4 SHA-1: b9d3995dc8f92ac21eb108f1c3629bacd78d9a61 SHA-256: 4084e0b4eaa3a33ac1f876edcdadadfafc1e1274507c752d3c99cd0c3a04772b
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1559 Component Object Model Hijacking T1559.001 Component Object Model Hijacking: Component Object Model

The RTF file contains an embedded OLE object and utilizes an ".objupdate" directive, strongly suggesting an attempt to exploit the Equation Editor vulnerability (CVE-2017-11882). The document body contains a lure instructing the user to 'Enable editing' to view the content, which is a common tactic for macro-based malware or exploits. The primary goal appears to be the execution of a secondary payload via the exploited vulnerability.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00005259.bin
e29604e4b77c040205c0418ca3217f3b92a524440f47cd69e8f45d9be5b872e9
rtf-objdata-decoded RTF \objdata at offset 0x5259 1974 bytes