RTF malware analysis — malicious · 8fc89bf19f14cfd2

MALICIOUS

RTF

110.7 KB First seen: 2024-07-23

MD5: e628ee1f2b81b8972f53e2b2785d97a1 SHA-1: 0fa0fe5809f166d707fdcf3a2a866b92a761a92b SHA-256: 8fc89bf19f14cfd251b0023a624d9be2eaf9a41328e7d5c6f1c703fea07c841d

160 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The RTF file contains multiple indicators of exploiting the Equation Editor vulnerability, including `RTF_EQUATION_EDITOR`, `RTF_OBJAUTLINK`, and `RTF_OBJUPDATE`. These heuristics strongly suggest that the file is designed to trigger code execution via a vulnerable OLE object within the Equation Editor component. The primary goal is likely to download and execute a secondary payload, a common technique for initial access.

Heuristics 4

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000012fa.bin` `646252fadb40112b5055e7271e020b7bee5672aaf20bf5e8af1e70a2a6469ba6`	rtf-objdata-decoded	RTF \objdata at offset 0x12FA	2367 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.