Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 976314b7a7802273…

MALICIOUS

RTF / .DOC

83.9 KB First seen: 2023-10-23
MD5: 4aa6ea3405f9bd2c4d2009e262c2d46c SHA-1: f43269a6c58648f43ca489f55b9e4f05e198d6cc SHA-256: 976314b7a78022730e95f94ec9bde2c2336be574eccdc364ac26757fc7c1e267
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 User Execution: Malicious Link T1059 Command and Scripting Interpreter

The sample is an RTF document that contains an embedded OLE object, specifically leveraging the Equation Editor vulnerability. The document body provides a lure to encourage users to 'Enable editing', which is a common tactic for macro-based malware. The presence of `RTF_EQUATION_EDITOR` and `RTF_OBJUPDATE` heuristics strongly suggests exploitation of the Equation Editor to achieve arbitrary code execution.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002811.bin
0e368dc19473232949a75c82792be402b96fb8df48e3f83f2201b28f0e5e6ccc
rtf-objdata-decoded RTF \objdata at offset 0x2811 1568 bytes