Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 9e91035c3e97367d…

MALICIOUS

RTF / .DOC

440.6 KB
MD5: afdbee33a66b0a6e969f131a8fdd9976 SHA-1: 559c0ffa7e5dcaef921826860a960da1fbeeccdd SHA-256: 9e91035c3e97367d4ee20e231b71739d0731539c8201aa7448d9683f73dbd31a
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document that contains an embedded OLE object, specifically targeting the Equation Editor vulnerability. The presence of `RTF_EQUATION_EDITOR` and `RTF_OBJAUTLINK` heuristics strongly indicates exploitation of this known vulnerability. The `RTF_OBJDATA` and `EXTRACTED_FILE_STATIC_TRIAGE` heuristics suggest that the embedded object is a payload that is likely executed upon opening the document, leading to a malicious outcome.

Heuristics 5

  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000006e7.bin
500a3d4993a008f6859f46b18c7e2752bee7f8c61b000916fc165c91d2e5f4f1
rtf-objdata-decoded RTF \objdata at offset 0x6E7 128557 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.