Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 6e2372c7c74619ba…

MALICIOUS

RTF / .DOC

215.4 KB First seen: 2021-10-26
MD5: fdc5df6be4ee5ac9b2c1ff8c7785c9f1 SHA-1: 7fdc6dfe6b95b21288dc86e3b7fd02744ed71785 SHA-256: 6e2372c7c74619ba3b798c2cf29801719dd07854d564a250490f1b27d8639030
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The critical heuristic firing for CVE-2017-11882 indicates a known vulnerability in Microsoft Equation Editor is being exploited. The presence of OLE object data and the \objupdate directive further suggest that embedded objects are being activated to trigger this exploit. This technique is commonly used to gain initial execution for delivering further malicious content.

Heuristics 3

  • CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
    Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000012c3.bin
07fb6a9d77e0aa57c4ccfe01ee8b74f55fd3a44d1ca77e3e718eecfc293b57be
rtf-objdata-decoded RTF \objdata at offset 0x12C3 4159 bytes