Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 754bdff8b4fedfa3…

MALICIOUS

RTF / .DOC

25.9 KB First seen: 2022-12-07
MD5: d03b4faff82b39ff657b947ed8360d3e SHA-1: ad8fc148bb619b9e461dfb8c7c23e039e95a88f7 SHA-256: 754bdff8b4fedfa39089c3f3f0ada4e010898fe8182e562e7edec59fb73cb732
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 User Execution: Malicious File

The sample is an RTF document that contains an embedded OLE object, specifically targeting the Equation Editor vulnerability. The document body includes a lure instructing the user to 'Enable editing' to view the content, which is a common tactic for macro-based malware delivery. The presence of RTF_EQUATION_EDITOR and RTF_OBJUPDATE heuristics strongly suggests exploitation of a known vulnerability to execute arbitrary code.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000045da.bin
a3f6310652d3e59188ed2f74fa9dccdbcdb4fd495ca5f092a447b5e4c67576c6
rtf-objdata-decoded RTF \objdata at offset 0x45DA 1451 bytes