RTF malware analysis — malicious · 6c740ef5de72e48b

MALICIOUS

RTF

17.5 KB First seen: 2020-01-07

MD5: a4589529c34b3a903aaf62f92e875e94 SHA-1: 235f13df8a385f207e9d41a12befa706de2edd6b SHA-256: 6c740ef5de72e48ba0b8de7241d6e924203403214fdb088557049ff8706f0de7

220 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that is automatically linked and updated, triggering an exploit. Heuristics and ClamAV detection specifically identify this as an exploit targeting CVE-2017-11882 within the Equation Editor component. This indicates the file's primary purpose is to leverage this vulnerability for code execution.

Heuristics 5

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Exploit.CVE_2017_11882-6934206-0
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000003f.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3F	7742 bytes
SHA-256: `e7af5da105fe8f414153d243b20eb37122150a32e8285b0ab5c7911e9f3afb51`

Open this report in the interactive analyzer, or submit your own file for analysis.