RTF malware analysis — malicious · 9fb51d2f4baea545

MALICIOUS

RTF

98.1 KB First seen: 2022-10-07

MD5: 588a63376d82fe2bc64a52a9165a61ec SHA-1: e91cbaa6b72ad6b6d16f1b34e364c3cd68c82ee5 SHA-256: 9fb51d2f4baea5451e3b8ce2a968bdbba76ca8af2d4f172cc64eba78d72adad8

160 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains an OLE object that triggers a buffer overflow vulnerability in the Equation Editor (CVE-2017-11882). This vulnerability allows for arbitrary code execution, which is commonly used to download and execute a second-stage payload. No document body or script content was available for further analysis, but the exploit itself is a strong indicator of malicious intent.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000004fc.bin` `5bc2699ac02ae72f3781db2ce0d4c8131b0335710c61b319b06d45ff59e24498`	rtf-objdata-decoded	RTF \objdata at offset 0x4FC	4672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.