Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 5cd70372f7605c0b…

MALICIOUS

RTF / .DOC

2.05 MB First seen: 2022-04-05
MD5: 4339529c2c884360d7d689d869b6dbf5 SHA-1: b224294dc1a9aff5a16aea0a51d44a7a9d51164d SHA-256: 5cd70372f7605c0b941f85ceb47a98fa4b817e435ffa4d9abb38079ce4800d4d
180 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains an embedded OLE object that exploits the Equation Editor vulnerability (CVE-2017-11882). This vulnerability is known to be used for arbitrary code execution. The decoded object data suggests the presence of a script, likely intended to download and execute a second-stage payload.

Heuristics 5

  • Equation Editor activation — CVE-2017-11882 related high CVE related CVE_2017_11882_ACTIVATION_RELATED
    RTF decodes to an Equation.3 ProgID and requests OLE activation with \objemb plus \objupdate. This reaches the legacy Equation Editor attack surface used by CVE-2017-11882/CVE-2018-0802 documents, but the malformed MTEF/native payload needed for stronger attribution was not recovered.
  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000012ab.bin
78d25525b624a4b2346d81561399c32f1e088f3189e6ba1491e4ba78645b6cbf		 rtf-objdata-decoded RTF \objdata at offset 0x12AB 86208 bytes
objdata_01_off00036d9a.bin
15b7f137c999929be510fea7aaa1c34a11c506a87bc2b1d42d45986f1d905f44		 rtf-objdata-decoded RTF \objdata at offset 0x36D9A 457432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.