Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 8fa928b2b1c71931…

MALICIOUS

RTF / .DOC

25.0 KB First seen: 2022-06-24
MD5: 0eb04e6d17858365c9d19bd44acf15c6 SHA-1: 352fbe92b879ce6a3f916170d4f196ad83ce5202 SHA-256: 8fa928b2b1c71931ab138dc1e1299fc03511cda89764e355d774e0daa9179968
160 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.001 PowerShell

The sample is an RTF document containing embedded OLE objects, specifically triggering heuristics for Equation Editor exploitation and OLE object activation. This indicates a likely attempt to exploit a known vulnerability in the Equation Editor component to achieve code execution. The embedded OLE object data suggests the potential for a secondary stage, such as downloading and executing a payload, although no specific URLs or scripts were extracted to confirm this.

Heuristics 4

  • Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM
    RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000017c2.bin
d6170bb929f19f94893173ede17c7385dc7efbf5a9fd730d6288f450c0d6b8a9
rtf-objdata-decoded RTF \objdata at offset 0x17C2 4247 bytes