Malicious RTF — malware analysis report

Static analysis result for SHA-256 8dfd6c0deb2f1331…

MALICIOUS

RTF

43.1 KB
MD5: edf915265c87cc2fccb85c9152b25538 SHA-1: b7ef7114359b56564026bcbd4d5c996b2ce80bc1 SHA-256: 8dfd6c0deb2f1331f4619a996e12d90a0475e222d1359b8e8a67267222085e51
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains embedded OLE objects and specifically targets the Equation Editor vulnerability. The presence of `RTF_EQUATION_EDITOR` and `RTF_OBJUPDATE` heuristics indicates an attempt to exploit this component, likely leading to arbitrary code execution. The document's structure suggests it was delivered as a spearphishing attachment.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001c86.bin
4fb7cea77c132dcce6a586e6e9159d3c23637e27af0bef249446f8c8f0c3f41d		 rtf-objdata-decoded RTF \objdata at offset 0x1C86 1917 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.