Malicious RTF — malware analysis report

Static analysis result for SHA-256 85ed27cc2b226429…

MALICIOUS

RTF

75.3 KB First seen: 2024-10-03
MD5: 33083e3d8cad434bfff8cdb97032babe SHA-1: 9defb395eda345c770a559ba6c46cba8226c2974 SHA-256: 85ed27cc2b2264295dfc90a985944887053ffe9a79894914ea7f69e6a7de42e2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.001 PowerShell

The RTF file contains an embedded OLE object with an Equation Editor ProgID, triggering heuristics for exploitation. The ".objupdate" directive forces the OLE object to activate, which is a common technique for exploiting the Equation Editor vulnerability (CVE-2017-11882). The embedded object data is likely a shellcode payload designed to download and execute further malicious content.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001ca1.bin
6970d73c2362ceb74df94e528edbbb8fb3a85c84456b9b38ee974de743c39b16
rtf-objdata-decoded RTF \objdata at offset 0x1CA1 1637 bytes