RTF malware analysis — malicious · 719d2f55fe2ce953

MALICIOUS

RTF

8.1 KB First seen: 2018-10-07

MD5: 758234cc80b2448316d8668a0e5e3ddc SHA-1: 2c37a90be933ca4ad44c1272e21bd3b9a226c624 SHA-256: 719d2f55fe2ce953eea82f76c46cacaef1f40223018030ce0e60d318ecf3221d

220 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains embedded OLE object data and is specifically flagged for exploiting the Equation Editor vulnerability (CVE-2017-11882). This exploit allows for arbitrary code execution on the victim's machine. The ClamAV detection confirms this specific exploit. No document body text or scripts were extracted, but the exploit itself is sufficient to determine the attack pattern.

Heuristics 5

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Exploit.CVE_2017_11882-6934206-0
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000003f.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3F	4134 bytes
SHA-256: `c52e4f76641c949732bc9bc5eb00f715e049cc69bc24253cf445253cc5a8ca2a`

Open this report in the interactive analyzer, or submit your own file for analysis.