Malicious RTF — malware analysis report

Static analysis result for SHA-256 6d2bb2be9546159c…

MALICIOUS

RTF

163.8 KB First seen: 2023-10-25
MD5: 2338eaf9ffc5099d2bf11689a7a66399 SHA-1: 78f2a7fd417fb18870c4d5008c533fc4eb70e2c1 SHA-256: 6d2bb2be9546159c9d8fd096d3da5737bbc8846694da82439624b2db9e993f4b
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File T1059.005 PowerShell

The file is an RTF document containing an embedded OLE object, specifically identified as an Equation Editor exploit. The document body contains a lure text instructing the user to 'enable editing', which is a common tactic to bypass security measures. The presence of the Equation Editor exploit strongly suggests an attempt to execute arbitrary code upon activation of the embedded object.

Heuristics 5

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000027c4.bin
8e37a0b01b4832f22e526bf5b9f63b1beae2cf8105555e8408ff343a468fa67d
rtf-objdata-decoded RTF \objdata at offset 0x27C4 1742 bytes