RTF malware analysis — malicious · 46f008af197286de

MALICIOUS

RTF

6.3 KB First seen: 2023-01-18

MD5: 187cf00caf6be8323db45f977b036c99 SHA-1: af62a3f28da4b773dc4f7a371baf49cf79e63e67 SHA-256: 46f008af197286de9ddeffb2f37d774c3b9490c3861a0ebdc0cec16efce5c9f0

200 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains an embedded OLE object that leverages the CVE-2017-11882 vulnerability in Microsoft Equation Editor. The presence of `RTF_EQUATION_EDITOR` and `CVE_2017_11882_ACTIVATION_RELATED` heuristics strongly indicates exploitation of this known vulnerability. The `RTF_OBJAUTLINK` and `RTF_OBJUPDATE` heuristics suggest that the embedded object is designed to be automatically activated, likely to download and execute a secondary payload.

Heuristics 5

Obfuscated Equation Editor ProgID + activation critical CVE related RTF_EQUATION_EDITOR

RTF decodes to an Equation.3 ProgID from top-level \objdata hex after nested RTF junk groups are ignored, and the document also contains \objemb plus \objupdate activation. This is an obfuscated Equation Editor exploit surface associated with CVE-2017-11882 / CVE-2018-0802 families, but no exact malformed MTEF CVE primitive was recovered from this object.
Equation Editor activation — CVE-2017-11882 related high CVE related CVE_2017_11882_ACTIVATION_RELATED

RTF decodes to an Equation.3 ProgID and requests OLE activation with \objemb plus \objupdate. This reaches the legacy Equation Editor attack surface used by CVE-2017-11882/CVE-2018-0802 documents, but the malformed MTEF/native payload needed for stronger attribution was not recovered.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000009ff.bin` `7164a6cbad113737b1b2b2234832287b891f1ae807394c34452440ab54da4784`	rtf-objdata-decoded	RTF \objdata at offset 0x9FF	1906 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.