RTF malware analysis — malicious · 5d6fbafbed3befc5

MALICIOUS

RTF

27.9 KB First seen: 2023-05-12

MD5: 96935f118fdeae482ef56256b22acf86 SHA-1: 326ee56fe73a4257aea97bb58a1b1bc38cbf43f9 SHA-256: 5d6fbafbed3befc57c4ce0889e1d381e98fba1f084b6fe169b6d692420854210

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object with critical heuristic firings indicating the use of Equation Editor, a known vector for exploits. The \objupdate heuristic suggests that the embedded object is designed to be activated automatically, likely triggering the exploitation of a vulnerability such as CVE-2017-11882. The decoded OLE object, objdata_00_off00001c16.bin, is the most direct indicator of the malicious payload.

Heuristics 3

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001c16.bin` `2d287eee117e7f2fbb8eb2557a59cb64edca4efc59b37afe7b411c3830debf9d`	rtf-objdata-decoded	RTF \objdata at offset 0x1C16	4174 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.