Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 6c8f43965962f12c…

MALICIOUS

RTF / .DOC

39.3 KB First seen: 2023-02-08
MD5: 29dbde556f2a1620b041059148b7af94 SHA-1: 8b7b4fedd88c3380bdd2d939091f8ea507100202 SHA-256: 6c8f43965962f12cf2d1607f5b59ea9dabadd58fd91ee13825fde6e9f11f6a32
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1059.005 Visual Basic

The file is an RTF document containing an embedded OLE object with a specific Equation Editor ProgID, indicating a likely exploit attempt. The presence of the \objupdate directive further suggests that the OLE object is intended to be activated automatically. The document body contains a lure instructing the user to 'Enable editing', a common tactic to bypass security measures and trigger the exploit.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00004921.bin
3432bf09b985832ecbc6ba96d1c81a682d357281e589dee383e240d87c1db664
rtf-objdata-decoded RTF \objdata at offset 0x4921 2049 bytes