equation-editor-exploit — RTF malware analysis

Static analysis result for SHA-256 4dc39d95a9f495de…

MALICIOUS

RTF

8.3 KB First seen: 2019-06-27
MD5: 294a0b9a202b662129d38bdb6eacf04f SHA-1: f86443e328db7ddf99deb2a7edaba7d780b4dd9a SHA-256: 4dc39d95a9f495deb801ac0376bd9b30811b40c79e46c855b865d51ef662d2dd
120 Risk Score

Malware Insights

equation-editor-exploit · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that triggers the Equation Editor vulnerability. This technique is commonly used to execute arbitrary code on the victim's machine. The presence of RTF_EQUATION_EDITOR and RTF_OBJUPDATE heuristics strongly indicates exploitation of this vulnerability.

Heuristics 3

  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000032.bin rtf-objdata-decoded RTF \objdata at offset 0x32 4138 bytes
SHA-256: 6637d9e157da95e77bac74311f75a2f0fb831854e1461f52bb11c634332b5bd9

Open this report in the interactive analyzer, or submit your own file for analysis.