Malicious RTF — malware analysis report

Static analysis result for SHA-256 82140d5a0bc99ee2…

MALICIOUS

RTF

13.0 KB
MD5: 10ea6889fd7ca096c9b307b276a03b99 SHA-1: 4b4ae4632d08f1c2dfd5339a2b00549d312347f5 SHA-256: 82140d5a0bc99ee26b616ef63ed4abdd6db3275342e54c9ec4ff4bc860336659
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document containing OLE object data, specifically targeting the Equation Editor vulnerability (RTF_EQUATION_EDITOR). This indicates an attempt to exploit a known vulnerability to gain code execution. The presence of OLE object data and automatic linking suggests the document is designed to trigger an exploit when opened. The likely intent is to download and execute a second-stage payload, although no specific URLs or scripts were extracted to confirm this.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001c6f.bin
abf7b120fb7327031e6ac237f6b11f45a0e17923e8e6fbb7b20e6f90ba6e6a04
rtf-objdata-decoded RTF \objdata at offset 0x1C6F 1868 bytes