Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 7f0f3941419dd02e…

MALICIOUS

RTF / .DOC

1.81 MB First seen: 2022-03-29
MD5: 1bcb6dfac243f6fcab671fa93c14dc7d SHA-1: 3db5a9391a8962c7467acce9b0e0c82afaa70d59 SHA-256: 7f0f3941419dd02e82dc168fd0e2d56e07a86e584cad9b6472d028eefb66007b
300 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious File: User Execution T1071.001 Application Layer Protocol: Web Protocols T1200 Hardware Add-in

The file is an RTF document containing multiple indicators of exploitation, specifically related to the Equation Editor vulnerability (CVE-2017-11882). The presence of OLE object data, excessive hex data, and composite monikers strongly suggests that the document is designed to trigger an exploit. ClamAV detection confirms this, identifying it as Rtf.Exploit.CVE_2017_11882-6584355-1. The exploit likely leads to the download and execution of a secondary payload.

Heuristics 7

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM
    RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • ClamAV: Rtf.Exploit.CVE_2017_11882-6584355-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Exploit.CVE_2017_11882-6584355-1
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~1896KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000125a.bin
9026daf442c686210777a2ff64fa8f32aaaf21a30c847cb174cc82c59b1c0d25		 rtf-objdata-decoded RTF \objdata at offset 0x125A 948306 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.