RTF malware analysis — malicious · 5b86ed5f163e7cd2

MALICIOUS

RTF

222.7 KB First seen: 2023-07-10

MD5: b7bd74867dd4f141daab18d01533c7d6 SHA-1: 3a899dc368067aefacfb62fd39b5209c02f5dacb SHA-256: 5b86ed5f163e7cd26260c46a2e7159062033b7d414c3ff6fada3ffcacd975dc1

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Phishing: Spearphishing Attachment

The RTF document contains an embedded OLE object with a split Equation Editor ProgID, indicating exploitation of CVE-2017-1188 or a similar vulnerability. The \objupdate directive forces OLE object activation, leading to arbitrary code execution. No document body or script content was available for further analysis, but the heuristics strongly suggest a classic Equation Editor exploit.

Heuristics 3

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000198e.bin` `c27f25a07ca4df984dbb657de67cdabf2e184667264eb4996d380fa2a9138854`	rtf-objdata-decoded	RTF \objdata at offset 0x198E	71734 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.