RTF malware analysis — malicious · 4d908fe1a46f7578

MALICIOUS

RTF

19.8 KB First seen: 2022-10-04

MD5: 1a85abd5b723d16b82cfa01d0cbd45f9 SHA-1: e4deeebd8838fde6a32977f2c3ad432dea837a29 SHA-256: 4d908fe1a46f757857993e8489529b15527e6ba7c8f8e1083c27edf8ab723ac9

160 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object with a specific CLSID associated with Equation Editor, triggering critical heuristics for RTF_EQUATION_EDITOR and RTF_OBJUPDATE. This indicates an attempt to exploit a known vulnerability in Equation Editor to achieve code execution. The embedded OLE object data (objdata_00_off00001417.bin) is the primary artifact, likely containing the malicious payload or a loader for it.

Heuristics 4

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001417.bin` `40001554098ec51db61478b702c9d24014b6551d88c7ba9ca659f1c3c3d78f24`	rtf-objdata-decoded	RTF \objdata at offset 0x1417	4166 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.