Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 9671db739bfdd2fe…

MALICIOUS

RTF / .DOC

4.6 KB
MD5: 9faeb135c3b9707b14b4d8ec908fd782 SHA-1: b0f00a0de56a24fe2bc28c606a1e0dedda2b6a19 SHA-256: 9671db739bfdd2febeb6de42bd5618f6c3c68608dbdf17fe94c173a3576e18fe
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1559.001 Component Object Model and Distributed Component Object Model

The RTF document contains embedded OLE object data, specifically targeting the Equation Editor component. The presence of RTF_EQUATION_EDITOR and RTF_OBJUPDATE heuristics indicates an attempt to exploit a known vulnerability within the Equation Editor to achieve code execution. The objdata section likely contains the shellcode for this exploit.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000000cd.bin
0b61d456bf185213a5d31f3761f961ab6c58e0e59006737e4f2a52385edbf21e
rtf-objdata-decoded RTF \objdata at offset 0xCD 2142 bytes