Malicious RTF — malware analysis report

Static analysis result for SHA-256 8bebe97050b9199b…

MALICIOUS

RTF

12.7 KB First seen: 2022-09-26
MD5: afee30a9a83102d0e1134aa039f779db SHA-1: afd80f660c671699a008798124b0d2ffc3e0d02e SHA-256: 8bebe97050b9199b8c7b978437b538ecf8ebdc6f10649247316690ece8e50502
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious Link: Malicious File T1059 Command and Scripting Interpreter T1059.005 Command and Scripting Interpreter: Visual Basic T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing Link

The sample is an RTF document that exploits the CVE-2017-11882 vulnerability in Microsoft Equation Editor. The document body contains a lure instructing the user to 'Enable editing', a common tactic to bypass security measures. The embedded OLE object data and the specific heuristic firings strongly indicate the exploitation of this known vulnerability, which is typically used to download and execute a secondary payload.

Heuristics 4

  • CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
    Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000eb0.bin
d9f73060084ed5c2bdf4f3b083c8200329c5417f1baf2e3ee82728080bdbb79f		 rtf-objdata-decoded RTF \objdata at offset 0xEB0 3655 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.