equation editor exploit RTF malware analysis — malicious · 9f05fc0d62bbb451

MALICIOUS

RTF

7.2 KB

MD5: 939c0f215d2c9f5599647261aa9fe74b SHA-1: 704b6fc4116ae3e653624ea4f1081597cec179a3 SHA-256: 9f05fc0d62bbb451cfeb45c29b08ba8c556fcbc0aabcb1b783c056cca004db6e

120 Risk Score

Malware Insights

equation editor exploit · confidence 95%

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.003 Windows Command Shell

The RTF file contains an embedded OLE object with a CLSID indicative of the Equation Editor. The ".objupdate" heuristic suggests that this object is designed to be activated automatically, triggering the exploitation of a known vulnerability in the Equation Editor. This is a common delivery mechanism for malware, often initiated via spearphishing attachments.

Heuristics 3

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000035.bin` `1b05c1208047474ced242b0f94be4320423acb5061f00ace150cc74f31a82ab2`	rtf-objdata-decoded	RTF \objdata at offset 0x35	3628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.