Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 9fa16e7a4ee87a1c…

MALICIOUS

RTF / .DOC

36.6 KB First seen: 2023-02-17
MD5: 6fea6d1408ccc123061f0accb4314cf9 SHA-1: 240c65388cdc0f89bfb10e520fdc32fbdb8e9829 SHA-256: 9fa16e7a4ee87a1ca62802e0a5055a0dc25e1a8d2e058e4ff60fd202af0d0ca6
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 User Execution: Malicious Link T1059.005 Command and Scripting Interpreter: Visual Basic

The RTF document contains an embedded OLE object with a specific Equation Editor ProgID and an objupdate directive, indicating an attempt to exploit vulnerabilities in these components. The document body includes a lure instructing the user to 'Enable editing' to view the content, which is a common tactic for macro-based malware delivery. The presence of these elements strongly suggests an exploit attempt targeting Office applications.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00004809.bin
ec18eb848dbe860d2e02e26d9ec2447fcdab69e3fc3dae0fca87a7349a23f050
rtf-objdata-decoded RTF \objdata at offset 0x4809 1460 bytes