Malicious RTF — malware analysis report

Static analysis result for SHA-256 701fdc68ee894bd3…

MALICIOUS

RTF

50.4 KB First seen: 2024-08-28
MD5: 3d01ed0fbd007ae72097e0054e330cbd SHA-1: 78720870c21366c6713b8f1d776f3497f8beaf4d SHA-256: 701fdc68ee894bd3579c91efc19f287b748ad744f49b1ec27774c47e7c24215f
140 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object and triggers an ".objupdate" directive, indicating an attempt to activate the object. Critical heuristics identify this as a likely Equation Editor exploit, a known method for executing arbitrary code. The embedded object data is likely a shellcode payload designed to download and execute a second-stage malicious file.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002057.bin
4c36a7da1e186fdef06c883804b40b6f9c4b339a3786525cc57be60c2abb444b		 rtf-objdata-decoded RTF \objdata at offset 0x2057 1953 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.