Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 9fa8f45febf0d7ce…

MALICIOUS

RTF / .DOC

18.4 KB
MD5: fca39575d7d7698ff7a350bddfc100a9 SHA-1: a962cd0b7c8aa722c45c97b8b1c91186f591bf2d SHA-256: 9fa8f45febf0d7ce5f0af202c575d7b058a00b7df9452931a5d3b2d68cef875c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains embedded OLE object data and triggers an objupdate event, indicating an attempt to activate embedded objects. The critical heuristic firing for CVE-2017-11882 strongly suggests exploitation of the Equation Editor vulnerability for arbitrary code execution. No document body or scripts were extracted, so the specific payload or delivery mechanism beyond the exploit is unknown.

Heuristics 3

  • CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
    Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002082.bin
90c123cd5fedacf259492e11d886bf49d95352a8faaab33067173d401d9406e4
rtf-objdata-decoded RTF \objdata at offset 0x2082 4157 bytes