RTF malware analysis — malicious · 4216dfbe7c803a46

MALICIOUS

RTF

14.8 KB First seen: 2022-10-06

MD5: a19810504567429fee94e77b38f21462 SHA-1: 110d3a30bffbd490664690b7deec204c5901ecaf SHA-256: 4216dfbe7c803a46e0958e95f24fcbbf14d491e49c47040b068e40893348bf56

200 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1559 Component Object Model Hijacking T1059 Command and Scripting Interpreter

The sample is an RTF document containing an OLE object that exploits the Equation Editor vulnerability (CVE-2017-11882). This vulnerability allows for the execution of arbitrary code, indicating the file's primary purpose is to compromise the system by delivering a secondary payload. No document body text or scripts were extracted, but the critical heuristic firing strongly suggests the exploit.

Heuristics 5

Equation Editor Ole10Native payload — CVE-2017-11882 likely critical CVE likely CVE_2017_11882_EQUATION_OLE10NATIVE

RTF decodes to an activated Microsoft Equation 3.0 OLE storage whose payload is a high-entropy Ole10Native stream rather than normal Equation Native/MTEF data. This is a weaponized Equation Editor RCE delivery shape consistent with CVE-2017-11882/CVE-2018-0802.
Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000072b.bin` `33bc30797c889daf3a0a0ee2fbc6ed2057329536f2804b48363f9441682a26b9`	rtf-objdata-decoded	RTF \objdata at offset 0x72B	3646 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.