RTF malware analysis — malicious · 91969065bab5523c

MALICIOUS

RTF

7.2 KB First seen: 2020-02-04

MD5: 9750dfd53a7fd89746af877296509448 SHA-1: fdd8e4c71d61b4ff2ffe7a6eea50326e309d3e2d SHA-256: 91969065bab5523c267976f941d452c1a975a43d8c32af5fe75ed150fef66869

160 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and specifically triggers heuristics related to Equation Editor vulnerabilities and OLE activation. This strongly suggests the file is designed to exploit a known vulnerability in Microsoft Equation Editor (CVE-2017-11882) to achieve code execution. The embedded OLE object likely contains shellcode or a payload designed to download and execute a secondary stage. The file's SHA256 hash is included as an IOC.

Heuristics 4

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000033.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x33	3631 bytes
SHA-256: `d064f45dc7bf222bafac0ed9e912203a42308bd46da3917407b138ef6e81a2be`

Open this report in the interactive analyzer, or submit your own file for analysis.