Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 606787be58b7d718…

MALICIOUS

RTF / .DOC

29.1 KB First seen: 2022-11-04
MD5: 1e86fd90c9978767e38d009fff2fddb0 SHA-1: c549388356a3d7bddc32dcf8ce87fa1fbbf50f5e SHA-256: 606787be58b7d7185c5aff148f83f16119ba7afe490766dc1a5f362c212f9896
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 User Execution T1204.002 Malicious File

The RTF document contains OLE object data and uses an \objupdate directive, indicating an attempt to activate embedded content. The heuristic 'SE_ENABLE_LURE' suggests the document prompts the user to enable editing or macros, a common tactic for malware droppers. The presence of RTF_EQUATION_EDITOR points to a potential exploit targeting the Equation Editor component.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000593f.bin
742ddde8109871072a95f4dabbc73388ffade0706b1964ef18f4e46cfd0dcf68
rtf-objdata-decoded RTF \objdata at offset 0x593F 1732 bytes