Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 8eeb2129668940a7…

MALICIOUS

RTF / .DOC

27.8 KB First seen: 2023-03-21
MD5: f95a3585584018b76f0580cea8f0eea0 SHA-1: ae4bcfcaf22baca075ef4ecba2e0e26759c409cd SHA-256: 8eeb2129668940a702ff4ceb868ff0772a3bdb3871e6e0244017a8462f0f6b7f
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an RTF document that contains an embedded OLE object, specifically targeting the Equation Editor vulnerability. The ".objupdate" directive indicates that the embedded object is intended to be activated automatically, which is a common lure to execute malicious code. The document body contains a lure to 'Enable editing', further supporting the malicious intent.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000517c.bin
aa11bfa0cf7230e5799af64789b1f966bd2fe1266f595619f6bd07d6add0e8cf
rtf-objdata-decoded RTF \objdata at offset 0x517C 1391 bytes