RTF malware analysis — malicious · 6d831aaa4b8ee1c4

MALICIOUS

RTF

1.62 MB First seen: 2020-07-24

MD5: 2bb2d4cd00b57d4f9a23cf1f47235dcf SHA-1: 18e0c460dde1db288f547cc8a6265bf365587ebb SHA-256: 6d831aaa4b8ee1c41b519dad3a7de26c9cae4d71786609a178a62560697c4078

240 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object that leverages the CVE-2017-11882 vulnerability in Microsoft Equation Editor. This vulnerability is used to execute arbitrary code, likely a second-stage payload. The decoded RTF object contains obfuscated VBScript-like content that attempts to execute 'C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay', which is a suspicious command that could be used to download and run further malware.

Heuristics 6

Obfuscated Equation Editor ProgID + activation critical CVE related RTF_EQUATION_EDITOR

RTF decodes to an Equation.3 ProgID from top-level \objdata hex after nested RTF junk groups are ignored, and the document also contains \objemb plus \objupdate activation. This is an obfuscated Equation Editor exploit surface associated with CVE-2017-11882 / CVE-2018-0802 families, but no exact malformed MTEF CVE primitive was recovered from this object.
CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000cdc.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xCDC	7781 bytes
SHA-256: `ff9317b7e938de634c0b8f1359d70f70ada2d402c166aa29e7266c008d42a118`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): WScript.CreateObject("WScript.Shell"), WScript.StdOut.WriteLine objExecObject.StdOut.ReadLine(
`objdata_01_off000054c1.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x54C1	126 bytes
SHA-256: `db29cb33d0389a69443b256652fafd0cdccca67e8937d31685a06e400455bacd`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`objdata_02_off000064b6.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x64B6	482391 bytes
SHA-256: `f3a1612bafa0265fae59e4254d4b2d89ad7ab4529bf1def86e1ddb2641b665ab`

Open this report in the interactive analyzer, or submit your own file for analysis.