RTF malware analysis — malicious · 49d137f7f8521f2f

MALICIOUS

RTF

76.1 KB First seen: 2024-07-31

MD5: 498755df4e7db2b5ccc26cf792c66b98 SHA-1: df4a766397291743f15c4996e93c6b2e0f7d077e SHA-256: 49d137f7f8521f2fcde3f3e94a14fbe32210baf3f15522383c5e59016c641f7b

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell

The RTF file contains an embedded OLE object with data that triggers the Equation Editor vulnerability. The ".objupdate" directive forces the OLE object to activate, leading to code execution. The embedded object data, decoded as objdata_00_off00000e36.bin, is the primary indicator of compromise, suggesting the file is a dropper for a secondary stage.

Heuristics 3

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000e36.bin` `32951bb0ef100ae2401f771f2953188ec1bfe73c58fee96619d303bd110e9a23`	rtf-objdata-decoded	RTF \objdata at offset 0xE36	1657 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.