RTF malware analysis — malicious · 83d5cf5ac94ea1d0

MALICIOUS

RTF

14.2 KB First seen: 2019-03-18

MD5: 010e5f3b363d6d5c999ceb88bae54fbb SHA-1: 2cbe451bbe20c5728d4d632de2b4c3396d0c2114 SHA-256: 83d5cf5ac94ea1d01924852f1ffdc3ae1ac03724cd5eed3d80c4d3f5ca84e851

260 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains an OLE object that leverages the CVE-2017-11882 vulnerability in Equation Editor. This exploit is commonly used to deliver secondary payloads. The presence of the ".bin" file and the specific OLE object details strongly indicate this malicious intent. No document body text or scripts were extracted, limiting further analysis of the payload's specific actions.

Heuristics 6

Equation Editor Ole10Native payload — CVE-2017-11882 likely critical CVE likely CVE_2017_11882_EQUATION_OLE10NATIVE

RTF decodes to an activated Microsoft Equation 3.0 OLE storage whose payload is a high-entropy Ole10Native stream rather than normal Equation Native/MTEF data. This is a weaponized Equation Editor RCE delivery shape consistent with CVE-2017-11882/CVE-2018-0802.
Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
ClamAV: Rtf.Dropper.Agent-7144414-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.Agent-7144414-0
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000803.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x803	4148 bytes
SHA-256: `f51e9d385544078a08cda5d8e4cb4611a85e84e46a4b5d60c17e4db5395c5aef`

Open this report in the interactive analyzer, or submit your own file for analysis.