RTF malware analysis — malicious · 5ce8f024d0f3798d

MALICIOUS

RTF

27.2 KB First seen: 2023-06-01

MD5: 174222aa212b2aecba8abf1b391e096f SHA-1: 949f033c5eb52ac5deca1988ed0f890d6e03ff44 SHA-256: 5ce8f024d0f3798d8e8fbbefe9bb177722ae696ed2608611f9740b3246b4544e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains OLE object data and specifically triggers heuristics for Equation Editor vulnerabilities and OLE object activation. This strongly suggests exploitation of a known vulnerability in the Equation Editor component to achieve code execution. The embedded OLE object data is the most significant artifact, likely containing the malicious payload or instructions to download it.

Heuristics 3

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000018f5.bin` `cf07916b3fb9ac359ef6f834f0e5361950e36cb01e40876ca951c59cbef34953`	rtf-objdata-decoded	RTF \objdata at offset 0x18F5	4163 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.