Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 41da4d097c8109b3…

MALICIOUS

RTF / .DOC

22.8 KB
MD5: 2d749292e09fe3087697210e5c391feb SHA-1: 6c6050e6bf41293b6a3f5bdb0330c3d34d5d9c9b SHA-256: 41da4d097c8109b3529c99c9dbdf0d5368c905543726116af8a2507ffae9ece2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document containing OLE object data and triggering heuristics for Equation Editor exploitation and OLE object activation. This indicates a likely attempt to exploit a known vulnerability in the Equation Editor component to achieve arbitrary code execution. The embedded OLE object data is the primary mechanism for this exploit, and the objupdate directive forces its activation upon opening the document.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000ff8.bin
a6ccf9bd402e374977391d6730c4c0f7f26ff02228b168ddd7bebc7bdd27fe60
rtf-objdata-decoded RTF \objdata at offset 0xFF8 1747 bytes