RTF malware analysis — malicious · 68b3b4b4b491482f

MALICIOUS

RTF

16.1 KB First seen: 2023-02-22

MD5: f5fa15de93803a87e9b2ab1a136607f9 SHA-1: a0f6c055032bcc2cb547e1be9c8ca2cea992ecd4 SHA-256: 68b3b4b4b491482f3c44e62d6b3863b5f4aeedb9608a6c27e4eeac44f8a375e3

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is an RTF document containing an embedded OLE object, specifically targeting the Equation Editor vulnerability. The presence of `RTF_EQUATION_EDITOR` and `RTF_OBJUPDATE` heuristics indicates a likely exploit attempt. The `RTF_OBJDATA` firing further confirms the embedding of executable content. This pattern is commonly used to deliver secondary payloads, hence the high confidence in an exploit execution attack pattern.

Heuristics 3

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000187d.bin` `c5b15b378151931d02c3eeb3749d2de8878ddc03fff012cf89069d6c7dc718be`	rtf-objdata-decoded	RTF \objdata at offset 0x187D	2208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.