Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 766612ef486b31c5…

MALICIOUS

RTF / .DOC

19.5 KB
MD5: e2d5e8ed269be08744cbc989d8b3f571 SHA-1: 8422d6177dac90789785ad7377d1acaf6b31166d SHA-256: 766612ef486b31c57aaab9b5c7b812fcff5ca8f11096075b25740e51294891d4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an RTF document containing embedded OLE object data, specifically triggering heuristics for the Equation Editor vulnerability. The \objupdate directive indicates an attempt to force the activation of this embedded object, which is a common method for exploiting CVE-2017-11882. This exploit typically leads to the execution of a secondary payload, hence the high confidence in an exploitation attack pattern.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000196b.bin
55ad12c1746c1bd005ef991ae6d7110f70ddc80af8e8d60548f480463236b962
rtf-objdata-decoded RTF \objdata at offset 0x196B 1790 bytes