RTF malware analysis — malicious · 8e36fffa202c9e53

MALICIOUS

RTF

11.3 KB

MD5: 14cda01ae1be762546f521a00352efb3 SHA-1: 42ab3eee3432569b7fb91b8cdf760eecdb8d306e SHA-256: 8e36fffa202c9e53540594a8032a2c13751dc6088007f62e7cdd08eea6d71c27

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains embedded OLE object data and specifically triggers heuristics related to Equation Editor exploitation and OLE object activation. This indicates a likely exploit attempt to gain code execution. The presence of RTF_EQUATION_EDITOR and RTF_OBJUPDATE heuristics strongly suggests the file is designed to leverage a known vulnerability in the Equation Editor component to deliver a malicious payload. Without further script or URL evidence, the exact nature of the payload remains unknown, but the pattern is consistent with a downloader or initial access exploit.

Heuristics 3

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001221.bin` `16ab8d74be168771e2789594d42ac0043c456fafea860cdb013ce5bf5d0d73b0`	rtf-objdata-decoded	RTF \objdata at offset 0x1221	2109 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.