Malicious RTF — malware analysis report

Static analysis result for SHA-256 a201f613030f8b36…

MALICIOUS

RTF

9.1 KB
MD5: 3eb3e5dc0602f16df7b56c73b0286c14 SHA-1: 87966db5ee2caf9793466ff6242120d103f288f2 SHA-256: a201f613030f8b36466b68b35c27ff7dd85edfc24c887713ce29d876e0c230a2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The sample is an RTF document that contains OLE object data and triggers an objupdate event, indicating it's designed to activate embedded objects. The critical heuristic firing for RTF_EQUATION_EDITOR strongly suggests exploitation of the Equation Editor vulnerability (CVE-2017-11882) to achieve arbitrary code execution. This is a common delivery mechanism for malware downloaders.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000d39.bin
27169efda8378ecc35a2118cfd1a342539b87e64aa45f7ac4d63640101c61484		 rtf-objdata-decoded RTF \objdata at offset 0xD39 2148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.