RTF / .DOC malware analysis — malicious · 4ae23afe5702e9bf

MALICIOUS

RTF / .DOC

59.0 KB First seen: 2023-03-09

MD5: 10a92fd9a9522fc5c1d1c4b379a996a8 SHA-1: 05dae10ad3fa83d51aca37b7c4b813a95f8840c2 SHA-256: 4ae23afe5702e9bf839aee4275ac233a2a98ebe8ebd2e5fa1c50046440e10706

200 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is an RTF document containing an embedded OLE object that exploits the CVE-2017-11882 Equation Editor vulnerability. The document body contains text about financial audits and prompts the user to 'Enable editing', indicating a social engineering lure to trigger the exploit. The embedded object is likely a payload designed to execute malicious code upon successful exploitation.

Heuristics 6

Equation Editor Ole10Native payload — CVE-2017-11882 likely critical CVE likely CVE_2017_11882_EQUATION_OLE10NATIVE

RTF decodes to an activated Microsoft Equation 3.0 OLE storage whose payload is a high-entropy Ole10Native stream rather than normal Equation Native/MTEF data. This is a weaponized Equation Editor RCE delivery shape consistent with CVE-2017-11882/CVE-2018-0802.
Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002b1d.bin` `f51d87b68ddc81efbec6c225532dedcda9866c41ed50d5e33088aec4ec5cfb02`	rtf-objdata-decoded	RTF \objdata at offset 0x2B1D	4161 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.