RTF malware analysis — malicious · 9a487fe8a41f589e

MALICIOUS

RTF

190.5 KB First seen: 2024-07-04

MD5: ff39cf1951ff9ba9687d57ba079c3b85 SHA-1: 61d7046c244831589e817143ada9c701d3243e20 SHA-256: 9a487fe8a41f589ee0df3285a4c1f86bd484232b0e7b1ac2ce92b2df57ef9e38

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The critical heuristic firing for CVE-2017-11882 indicates the file is designed to exploit a known vulnerability in the Microsoft Equation Editor. The presence of OLE object data and the \objupdate directive further support that this is an exploit document. The exact payload is not discernible from the provided evidence, but the exploit's purpose is to achieve code execution.

Heuristics 3

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001f24.bin` `d3fcdec5b25f22b938b6e97a9b0b26d40326ad3c1786369ee8dade329aa1fc8b`	rtf-objdata-decoded	RTF \objdata at offset 0x1F24	4171 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.