Malicious RTF — malware analysis report

Static analysis result for SHA-256 8231f3248221bb7a…

MALICIOUS

RTF

276.8 KB Authoring application: Riched20 6.3.9600 First seen: 2021-06-17
MD5: 49103e14517dfad149592c9c5ef977e7 SHA-1: 85b783aaefbc681d2e33fa1494f5a2bd5ce4e480 SHA-256: 8231f3248221bb7abb575afe6369b49b22bc40f2332786eb0bc78594aca01e99
240 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains an embedded OLE object specifically identified as Microsoft Equation Editor, triggering critical heuristics for exploitation. ClamAV detection confirms this as Rtf.Exploit.CVE_2018_0802-6624871-1, indicating a known exploit targeting Equation Editor. This strongly suggests the file is designed to execute arbitrary code upon opening, likely delivered via spearphishing.

Heuristics 6

  • ClamAV: Rtf.Exploit.CVE_2018_0802-6624871-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6624871-1
  • Equation Editor object class critical RTF_OBJCLASS_EQUATION
    Object class 'equation.3' references Equation Editor
  • Equation Editor ProgID + OLE object high RTF_EQUATION_EDITOR
    RTF references Equation.3 ProgID alongside \objdata — likely Equation Editor (CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798) but without the binary CLSID payload, so flagged at HIGH instead of CRITICAL.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000100.bin rtf-objdata-decoded RTF \objdata at offset 0x100 27604 bytes
SHA-256: ab4a1a9a691ee50ced24b26543d026a9513d4b68ca776207644a61b711a6cdda

Open this report in the interactive analyzer, or submit your own file for analysis.