MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious File
The RTF document contains embedded OLE objects, specifically identified as Microsoft Equation Editor, which is a known vector for exploiting vulnerabilities. The presence of RTF_EQUATION_EDITOR and RTF_OBJCLASS_EQUATION heuristics strongly suggests an exploit targeting this component. While no scripts were extracted, the structure indicates a likely attempt to execute arbitrary code via the embedded object, leading to a malicious payload delivery.
Heuristics 6
-
Ole10Native stream in RTF OLE object high RTF_OLE10NATIVE_STREAMRTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
-
Equation Editor CLSID critical RTF_EQUATION_EDITOREquation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
-
Equation Editor object class critical RTF_OBJCLASS_EQUATIONObject class 'equation.3' references Equation Editor
-
OLE object data medium RTF_OBJDATARTF contains 1 \objdata section(s) — embedded OLE objects
-
Embedded OLE object medium RTF_OBJEMBRTF contains \objemb — embedded OLE object
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.microsoft.com/office/word/2003/wordml
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
objdata_00_off00004922.bin484c40f226cb4f4c3616404da72dec801a7197580651a6cff81c5f4d615a3d67 |
rtf-objdata-decoded | RTF \objdata at offset 0x4922 | 7392 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.