Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 5e719cefe52f3351…

MALICIOUS

RTF / .DOC

210.9 KB
MD5: 0d1e47f9c9e97439af102247df16e32f SHA-1: e6c179251a9ced22d13c32d8f3e7bc148347bbf1 SHA-256: 5e719cefe52f3351eeb10b2aa74d5454493bd1365ca8258867ffa2affe8a17b3
160 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and triggers automatic linking and updates, indicative of exploitation. Specifically, the critical heuristic firing for CVE-2017-11882 confirms the use of this known vulnerability in the Equation Editor. This exploit is commonly used to achieve arbitrary code execution, typically to download and run a malicious second-stage payload.

Heuristics 4

  • CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
    Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001979.bin
8dcde7121f557e44ab449c49f6eca34bbb2d9371bd10e6e6ca8f64b737530a1a
rtf-objdata-decoded RTF \objdata at offset 0x1979 3654 bytes