Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 9a815e6af4b54033…

MALICIOUS

RTF / .DOC

68.9 KB
MD5: 70405eebd81087d9da4a61b24c26c517 SHA-1: d1dabcba1a3625c5c029080d92293afa295cdcef SHA-256: 9a815e6af4b5403314770f92be2d6bd11673c6711fbd42dd5938fad55412c415
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.003 Windows Command Shell

The RTF document contains an embedded OLE object with data indicative of an Equation Editor exploit. The presence of \objdata and \objupdate directives strongly suggests that the document is designed to trigger an arbitrary code execution vulnerability within the Equation Editor component when opened. This is a common technique for delivering a malicious payload.

Heuristics 4

  • Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM
    RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000003c.bin
0310eae9f3293517f1af615d60006f847e43867937fd1e7d55340dd98c7bfa8e
rtf-objdata-decoded RTF \objdata at offset 0x3C 19990 bytes