RTF malware analysis — malicious · 626160c0b359bc87

MALICIOUS

RTF

42.6 KB Created: 2019-06-20 Authoring application: Microsoft Word 11.0.5604 First seen: 2019-11-20

MD5: a0ab66dc0e3f0c36d162853df7132968 SHA-1: 92f5b35847b3c4fb1b888a01da1affcc6f29a8ae SHA-256: 626160c0b359bc87151aad402b1925f73751bf0e68ffe84b095de63f5ae2e4b0

242 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains multiple OLE objects and specifically triggers the Equation Editor, indicating exploitation of CVE-2018-0798. This vulnerability allows for arbitrary code execution, likely to download and run a secondary payload. The presence of OLE objects and the specific CVE points to a malicious document designed for initial compromise.

Heuristics 7

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
CVE-2018-0798 — Equation Editor Matrix record overflow critical CVE exact CVE_2018_0798

RTF contains hex-encoded MTEF Matrix record exploit signature (NOP-sled 0x60 + padding 0x61 + return address 0x0BFB). CVE-2018-0798 exploits a stack buffer overflow in EQNEDT32.EXE's Matrix record parser and affected Equation Editor broadly, including builds patched for CVE-2017-11882. Widely used by APT groups (Conimes, KeyBoy, Emissary Panda, Rancor).
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000131a.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x131A	4204 bytes
SHA-256: `01e2a1c9f1cdcb1f7bb1dfd71db886fe77659d2a10dd16d096c33c4a8798546c`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.95, consistent with packed or encrypted content.
`objdata_01_off0000345b.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x345B	3046 bytes
SHA-256: `0074a0cc7ee3709727e555ec45a69eb567c6d1d29b9f0a1d15a21dedcee1099d`
`objdata_02_off00004c53.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4C53	11848 bytes
SHA-256: `b6e21f5b426a27256d5f2a6be41486d88945230168344991c1eeed468dd77fee`
`objdata_03_off00004c7e.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4C7E	35 bytes
SHA-256: `676a41c53ef784a4dff762ec36db2ae6c0e573f45b3f249da78a42f5ef356d14`

Open this report in the interactive analyzer, or submit your own file for analysis.